US state privacy laws: cookie rules outside California

Which states have a privacy law?

Since California passed the CCPA in 2018, eighteen more states have adopted comprehensive consumer privacy laws, all of them in force by 1 January 2026: Virginia (1 January 2023), Colorado and Connecticut (1 July 2023), Utah (31 December 2023), Texas and Oregon (1 July 2024), Montana (1 October 2024), Delaware, Iowa, Nebraska and New Hampshire (1 January 2025), New Jersey (15 January 2025), Tennessee (1 July 2025), Minnesota (31 July 2025), Maryland (1 October 2025), and Indiana, Kentucky and Rhode Island (1 January 2026). Florida has a narrower law aimed at very large platforms. More states have bills pending, and several existing laws have been amended to lower thresholds or add children's protections.

The laws follow the Virginia template rather than California's, so they are more alike than different. This page describes the common model and flags the main variations; for California, which is the outlier, see the CCPA/CPRA page.

Who do they apply to?

Each law applies to businesses that conduct business in the state or target its residents and meet a threshold. The usual tests are controlling or processing the personal data of 100,000 or more residents in a year, or 25,000 or more residents while deriving a share of revenue (often 25% to 50%) from selling personal data. Some states set lower numbers: Connecticut moved to 35,000 consumers, Delaware and New Hampshire use 35,000, Montana 50,000, and Maryland 35,000. Texas and Nebraska take a different approach and cover every business that is not a small business under the US Small Business Administration's definition, with a specific rule that even small businesses need consent before selling sensitive data. Most laws exempt non-profits, higher education, and data covered by federal laws such as HIPAA and GLBA, with Oregon, Delaware, New Jersey, Minnesota and Maryland reaching some non-profits.

What do they require for cookies and trackers?

The laws regulate what the data is used for, not the cookie itself. Three concepts drive the obligations:

• Targeted advertising: displaying ads selected on the basis of personal data obtained from the consumer's activity across non-affiliated websites or apps. Advertising pixels and ad network cookies do exactly this. Consumers have the right to opt out.
• Sale of personal data: exchange for money (Virginia, Iowa, Indiana, Tennessee, Utah, Kentucky) or for money or other valuable consideration (Colorado, Connecticut, Texas, Oregon and most of the newer laws, which catch data shared with ad tech partners without payment). Consumers may opt out.
• Sensitive data: health, race, religion, sexual orientation, precise geolocation, children's data and similar categories. Processing it requires opt-in consent, and Maryland bans selling it altogether.

Analytics for the site's own use is generally allowed without consent, with notice in the privacy policy. Profiling in furtherance of decisions with legal or similarly significant effects carries an opt-out right in most states, and data protection assessments are required for targeted advertising and sales.

Universal opt-out signals. The big practical difference between states is whether a business must honor a browser or extension signal, such as Global Privacy Control, as an opt-out request. California, Colorado (since 1 July 2024), Connecticut (since 1 January 2025), Texas, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland and Oregon (since 1 January 2026) require it; the Colorado Attorney General maintains a public list of recognized mechanisms with Global Privacy Control as the only entry so far. Virginia, Utah, Iowa, Tennessee, Indiana, Kentucky and Rhode Island do not require it. Since a signal is global, most businesses honor it everywhere.

Dark patterns. Colorado, Connecticut and most of the newer laws say that consent obtained through a dark pattern is not consent, and Colorado's rules spell out design standards for choices.

Children and teenagers. Several laws require opt-in consent for targeted advertising or sales involving consumers aged 13 to 15 (Connecticut, Delaware, New Jersey, Oregon, Maryland among others), and Maryland prohibits targeted advertising to anyone under 18 the business knows or should know about.

What must a compliant notice do?

• A privacy notice that lists the categories of data, the purposes, the categories of third parties, whether data is sold or used for targeted advertising, and how to exercise rights.
• A clear and conspicuous way to opt out of targeted advertising and sales, often a "Your privacy choices" or "Do not sell or share my personal information" link, with the opt-out taking effect within 15 to 45 days depending on the state.
• Recognition of Global Privacy Control where required, applied to the browser and, if the visitor is logged in, to the account.
• Opt-in before processing sensitive data or known children's data.
• An appeals process for refused requests, and an authorized agent process in most states.

A cookie consent banner in the EU style is not required and does not replace the notice, but a banner configured for opt-out can carry the link and respond to the signal.

Enforcement and fines

Attorneys general enforce, with civil penalties generally up to $7,500 per violation (Virginia, Connecticut, Texas, Oregon, Montana and most others), $20,000 per violation in Colorado, and cure periods that have expired in most states (Connecticut's on 1 January 2025, Oregon's on 1 January 2026). There is no private right of action.

Enforcement arrived in 2025. On 13 January 2025 the Texas Attorney General sued Allstate and its subsidiary Arity under the Texas Data Privacy and Security Act, alleging that tracking software embedded in mobile apps collected the location and driving data of more than 45 million Americans without notice or consent, the first lawsuit by a state attorney general under a comprehensive privacy law. On 8 July 2025 the Connecticut Attorney General announced an $85,000 settlement with TicketNetwork, whose privacy notice was unreadable, omitted rights and whose opt-out mechanisms were broken, the first penalty under the Connecticut Data Privacy Act. In September 2025 California, Colorado and Connecticut announced a joint sweep of businesses that fail to honor opt-out preference signals. Expect cookie-level findings: the first wave of letters focused on advertising trackers that keep firing after a visitor opts out or sends a GPC signal.

How Cookiequiet handles US state laws

For visitors in US states with a privacy law (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the others), Cookiequiet can show an opt-out notice instead of the consent banner, with a "Do not sell or share my personal information" link that opens the preference center, and it honors Global Privacy Control as an opt-out automatically. Marketing tags held in the category system stop when the visitor opts out, Google Consent Mode v2 switches ad personalization off, and each opt-out is written to the consent log with its date and the banner version so you can show how a request was handled. Elsewhere in the US you can show nothing, the same notice, or the full banner. Cookiequiet's policies are templates written for the CCPA/CPRA rather than for every state law, so check the state-specific disclosures, such as Texas's required sensitive data notice, with your advisor. See also the Do Not Sell link explained.