Cookie banners in the US: when you need one
There is no federal cookie law in the US, yet many sites still need a cookie banner or an opt-out link. When you need one, what it should do and what to avoid.
In the US, no federal law requires a cookie banner. You may still need one, or at least an opt-out mechanism, if a state privacy law applies to your business, if you collect sensitive data such as health information, if you target visitors in Europe, or if you want to lower the risk of privacy lawsuits over tracking tools. Many small US businesses fall under none of these and need only an honest privacy policy, but you should check rather than assume.
The confusion comes from the European model. In the EU and UK, most non-essential cookies need opt-in consent before they load, which is why European sites greet you with a banner. The US took a different path: mostly opt-out rights, set state by state. This guide explains when a cookie banner in the US makes sense and what it should do. It is not legal advice; laws change quickly in this area, so confirm with your attorney.
The US model: notice and opt-out
Most US state privacy laws do not ask you to get consent before setting cookies. Instead, they give consumers rights, including the right to opt out of:
- The sale of their personal information
- The sharing of it for cross-context behavioral advertising (California's term)
- Targeted advertising and some types of profiling (the term most other states use)
Here is the part that catches small businesses: ad pixels and some analytics setups can count as "selling" or "sharing" under these laws, because data about your visitors goes to an ad platform that uses it for advertising. So if a state law applies to you and you run Meta or Google ad tags for retargeting, you may need a way for visitors to opt out. That is usually a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, a banner, or both. The details of which laws apply are in US state privacy laws and your website.
When a banner or opt-out is likely needed
| Situation | What you may need |
|---|---|
| A state privacy law applies to you and you run ad pixels | Opt-out link, honoring Global Privacy Control, often a banner |
| You process sensitive data (health, precise location, children) | Possibly opt-in consent before certain processing, depending on the state |
| You target customers in the EU or UK | Opt-in consent banner for non-essential cookies |
| You use chat widgets, session recording or pixels on sensitive pages | Consider a banner and a careful review, given wiretap lawsuits |
| Small local business, no state law threshold met, basic analytics only | Usually a clear privacy policy, no banner required |
Sensitive data changes the picture
Several state laws require opt-in consent before processing sensitive data, which often includes health conditions, precise geolocation, racial or ethnic origin, sexual orientation and data about children. Washington's My Health My Data Act goes further for consumer health data and lets individuals sue. If your website serves health, wellness or similar topics, tracking on those pages needs extra care. Healthcare providers should read HIPAA and website tracking as well.
The lawsuit factor
In recent years, plaintiffs' firms have filed many lawsuits in California and other states using older wiretapping and privacy laws. They target website chat tools, session replay software and tracking pixels, arguing that visitors' communications were shared with third parties without consent. Courts have gone both ways, and the law is still developing. Some businesses add a consent banner and clear disclosures partly to reduce this risk. Ask your attorney whether it is worth it for your site.
What a good banner actually does
A banner that only shows a message and an "OK" button does little. A useful setup:
- Knows what your site runs. List every tag: analytics, ad pixels, chat, video embeds, heatmaps.
- Sorts tags into categories: strictly necessary, analytics, advertising, functional.
- Blocks or adjusts tags based on the visitor's choice and location.
- Detects Global Privacy Control and treats it as an opt-out where required.
- Uses equal, clear choices. Hiding "decline" behind three clicks is the kind of design regulators call a dark pattern.
- Records choices so you can show what a visitor agreed to.
- Links to your privacy and cookie policy, written in plain language.
For Google tags, Consent Mode passes the visitor's choice to Google Analytics and Google Ads so they adjust what they store. It is required for personalized advertising to visitors in the European Economic Area and useful in the US where you run a consent tool. The Consent Mode service covers how I set it up.
Opt-in or opt-out for a US site?
If your audience is almost entirely in the US, an opt-out model is common: tags load, a banner or footer link lets visitors opt out, and GPC signals are honored automatically where required. If you have meaningful EU or UK traffic you target, you may use geolocation to show an opt-in banner there and an opt-out model in the US. If you handle sensitive data, opt-in for the relevant tags may be the safer choice everywhere.
Common mistakes
- A banner that changes nothing. All tags fire whatever the visitor clicks.
- A copied privacy policy that mentions tools you do not use and misses the ones you do.
- Pixels on sensitive pages such as health intake forms or patient portals.
- No owner. New tags get added by an agency or plugin and never reach the banner settings.
- Forgetting the "Do Not Sell or Share" link where a state law requires it.
How to start
Make a list of every tag on your site, decide with your attorney which laws apply, then configure a consent tool that actually controls those tags. Review it whenever you add a new marketing tool. The website legal pages guide explains how the privacy policy fits in. I set up consent tools, Google Consent Mode and tag rules as part of analytics work; GA4, Tag Manager and pixels together cost $550, and more complex consent setups are quoted after a short call.
Let’s talk
about your business
Before the call I review your website and ads. After the call you get an action plan and a price range in writing.
12+ years in online marketing, 100+ clients. I build websites, Google Ads and Meta ads campaigns, CRMs and automations for small and mid-sized businesses. About me →
Cookie banner questions
Is a cookie banner legally required in the US?
There is no federal law that requires one. Whether you need a banner, an opt-out link or nothing beyond a privacy policy depends on which state laws apply to your business, whether you process sensitive data such as health information, and whether you target visitors in Europe. Confirm your situation with an attorney.
What is Global Privacy Control?
Global Privacy Control, or GPC, is a signal some browsers and extensions send to tell websites the visitor opts out of the sale or sharing of their data. California and several other states require covered businesses to treat it as a valid opt-out request. Your consent tool should detect it.
Does a cookie banner hurt my analytics?
An opt-in banner usually reduces the data you collect, because some visitors decline. An opt-out approach, common in the US, usually keeps most of it. Google's Consent Mode can model some of the missing data for ads. The right choice depends on the rules that apply to you, not on analytics alone.
Can I use a free cookie banner plugin?
You can, but check what it actually does. Many free banners only show a message and never block any tags, which gives you the look of compliance without the substance. Test that declining or opting out really stops the tracking.
Not sure what your
website needs?
I review which tags your site runs and set up consent tools, Consent Mode and opt-out handling that match your situation. Your attorney confirms the legal side.