Do US Websites Need a Cookie Banner?

No US state comprehensive privacy law we read requires an EU-style opt-in cookie banner before ordinary analytics or advertising cookies load. The state instruments checked for this piece, as of August 2026, were California's regulations plus Virginia and Texas, and all three run on an opt-out model: you disclose that you sell personal data or process it for targeted advertising, and you tell the consumer how to opt out. What genuinely triggers a prior-consent requirement is different: sensitive data, where Virginia's 59.1-578(A)(5) says a controller shall "not process sensitive data concerning a consumer without obtaining the consumer's consent," and health data in Washington, where RCW 19.373.030 requires consent before collection and a separate, distinct consent before sharing. Genuine opt-in before cookies load is a European requirement, from ePrivacy Article 5(3). The contrarian conclusion follows: a great many US sites run intrusive consent banners they do not owe, while failing the opt-out signal obligation they do.

This article covers what US law actually requires at the point of collection, the two carve-outs that do demand consent, when the European rules reach a US site, and what to build instead of the banner you probably have.

Key takeaways

• The state laws checked here give consumers a right to opt out of sale and targeted advertising, not a right to withhold consent before tracking begins.
• What US law does require at the point of collection is notice, and in California the notice rule has teeth: no notice, no collection.
• Two carve-outs demand real consent: sensitive data under the state laws, and consumer health data under Washington's My Health My Data Act.
• Prior consent before cookies load comes from the EU's ePrivacy rules, and it reaches you when you target or track people in the EU.
• If you do show a banner, California's regulations govern its design, and an "Accept All" plus "More Information" pair is expressly called out as non-compliant.

What the state laws actually require: notice, not consent

California's regulations put the notice duty in the strongest form of any US rule we read. Section 7012 requires a Notice at Collection "at or before the point of collection," listing the categories of personal information to be collected including sensitive categories, the purposes, and whether the information is sold or shared. Subsection (d) is the enforcement hook: "if a business does not give the Notice at Collection to the consumer at or before the point of collection of their personal information, the business shall not collect personal information from the consumer."

That is a hard rule, and it is the one people miss because it is not a banner. The regulation's own examples of how to satisfy it are undramatic: a conspicuous link to the notice on the introductory page and on every page where personal information is collected; a link near a webform's fields or submit button; a link on a mobile app's download page and in its settings.

Virginia's structure is the model most other states copied. Section 59.1-578(D) requires that "if a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing." Disclose and offer an opt-out. Not: obtain consent first.

So the honest US answer for ordinary analytics and advertising cookies is a privacy notice that describes them accurately, a working opt-out route, and, if you sell or share, honoring the browser signal. That last one is not optional and is covered in do you have to honor Global Privacy Control.

The carve-outs that do require consent

Sensitive data. Virginia's 59.1-578(A)(5) requires consent before processing sensitive data, and 59.1-575 defines the category: personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to uniquely identify a person; personal data collected from a known child; and precise geolocation data. Precise geolocation is defined as identifying a person's location "with precision and accuracy within a radius of 1,750 feet," which is a smaller circle than most product teams assume when they add a location feature.

Consent in that statute is "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement," which is materially the same standard as GDPR Article 4(11). If a tag on your site infers health conditions, or an SDK collects fine-grained location, you are in consent territory in the states that follow this model, and the fix is a targeted consent flow for that data rather than a site-wide banner.

Health data in Washington. The My Health My Data Act is the sharpest US departure from the opt-out norm. RCW 19.373.030 requires consent from the consumer before collecting consumer health data for a specified purpose, and consent for sharing "that is separate and distinct from the consent obtained to collect." Two consents, not one, and the request has to disclose the categories involved, the purpose, the recipients, and how to withdraw. The definition of consumer health data is broader than a clinical record, which is why non-health companies with wellness, fitness or symptom-adjacent features keep discovering they are inside it.

Children. Data collected from a known child is sensitive data under the Virginia model and is separately governed by federal law. That is its own analysis and outside this article's scope, but if your product has under-13 users, none of the general guidance above is sufficient.

When the European rules reach a US site

Article 5(3) of the ePrivacy Directive is the actual source of the EU cookie banner, and it is not a GDPR provision. It requires that "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information."

Two exemptions follow in the same paragraph: technical storage or access "for the sole purpose of carrying out the transmission of a communication over an electronic communications network," and storage "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." Session cookies that keep a shopping cart working sit inside the second exemption. Analytics and advertising do not, which is why European banners exist and why they must be answered before those scripts run. The consent standard is GDPR's, from Article 4(11): freely given, specific, informed and unambiguous, by a statement or clear affirmative action.

Whether that reaches your US site is the territorial-scope question, and it is not answered by whether Europeans can find you. We walk it in does GDPR apply to my US company; the short version is that intentional targeting or behavioural monitoring is the test, and mere accessibility of a website in the Union is expressly insufficient.

If you do show a banner, California governs how it looks

Here is the part that catches companies who installed a consent tool to be safe and never read the rules that apply to the tool. California's section 7004 requires that methods for obtaining consent present symmetrical choices, and it names cookie banners specifically.

The regulation states that "a website banner that provides only the two options, 'Accept All' and 'More Information,' or, 'Accept All' and 'Preferences,' when seeking the consumer's consent to use their personal information is not equal or symmetrical because the method allows the consumer to 'Accept All' in one step, but requires the consumer to take additional steps to exercise their rights." The symmetrical version it offers is "Accept All" and "Decline All." It also rules out a "yes" button more prominent than the "no" button, whether by size or by a more eye-catching color, and it provides that "a consumer closing or navigating away from a pop-up window on a website that requests consent without first affirmatively selecting the equivalent of an 'I accept' button shall not constitute consent."

So the default configuration of a great many consent tools, one prominent accept button and a secondary link to preferences, is the example the regulation uses to illustrate what is not compliant. If you are going to run a banner you do not owe, at least do not run one that creates an exposure you did not have.

What to build instead

For a US-only audience with no sensitive-data processing:

1. A Notice at Collection that is genuinely reachable at or before collection, linked from the homepage and from every page that collects personal information, and accurate about categories, purposes, and whether you sell or share.

2. Detection and honoring of the opt-out preference signal, server-side, gating tag loading rather than firing after the fact.

3. A privacy policy that describes each tag, its vendor and its purpose, so that the notice and the network tab agree.

4. A working opt-out route for sale and targeted advertising, plus the mechanics for the other consumer rights.

5. A documented decision, with a date on it, about whether your data flows constitute a sale or a share under each applicable law.

Add a consent flow only for the specific processing that needs one: sensitive data as those statutes define it, consumer health data in Washington, and any EU-facing property. Scoping consent to the processing that requires it is both cheaper and more likely to survive contact with a regulator than a site-wide banner nobody configured for the rules that govern banners.

When you should not hire a consultancy like this one

If you run a US-only marketing site with analytics, no advertising pixels, no location collection and no health-adjacent features, this whole subject is a privacy policy, a notice link, and a GPC implementation. That is an afternoon. Do not buy a consent platform, and be wary of any advisor who leads with one, ourselves included: a firm that sells privacy programmes has an obvious interest in your believing that this is complicated.

The complexity threshold is real but it sits further out than the vendors suggest. It shows up with EU-facing properties, an advertising stack nobody has fully inventoried, product features touching health or precise location, an acquisition that brought someone else's tag manager, or a business model where whether something counts as a sale is a genuinely close call. Those are the engagements where the analysis changes the answer.

Where Top Floor fits

Our CCPA service covers the notice at collection, the opt-out mechanics and the banner-design rules if you decide to run one. Global privacy is where a single posture gets built across the states rather than one per state, which is nearly always the cheaper build. If a scope memo says the European rules do reach one of your properties, GDPR picks up the consent standard and the lawful-basis work that follows. The state-by-state picture we maintain is at our US privacy laws resource.

How to decide this week

1. Open your site in a private window and list every network request that fires before you touch anything. That list, not your privacy policy, is what you are actually doing.

2. For each item on the list, name the vendor and the purpose. Anything you cannot name is a finding.

3. Check whether any feature collects precise geolocation, infers health information, or is used by known children. If yes, you are in consent territory regardless of the banner question.

4. If you already run a banner, hold it against section 7004: are the accept and decline options equal in steps and in prominence?

5. Confirm your Notice at Collection is reachable at or before collection, because in California failing that means you may not collect at all.

Frequently asked questions

Does any US law require a cookie banner?

None of the comprehensive state privacy laws checked for this article require an EU-style opt-in banner before ordinary analytics or advertising cookies load; they require disclosure and an opt-out route instead. What US law does require at that moment is notice, and California's rule is strict: if the business does not give the Notice at Collection at or before the point of collection, it may not collect personal information at all. Consent is required for narrower categories, principally sensitive data under the state laws and consumer health data in Washington.

We serve a few European visitors. Do we need an EU-style banner?

Not on visitor counts alone. The ePrivacy consent requirement bites when the EU regime reaches you, and territorial scope turns on whether you intentionally target people in the Union or monitor their behaviour there, with the mere accessibility of a website in the Union expressly insufficient to establish targeting. Run that scope analysis first and write it down, because the answer decides whether you owe prior consent or a notice and an opt-out.

Is precise geolocation really sensitive data?

Under the Virginia model, yes, and the threshold is tighter than most teams expect. Virginia defines precise geolocation data as information that identifies a person's specific location with precision and accuracy within a radius of 1,750 feet, and it sits in the sensitive data category alongside health diagnosis, biometric identifiers and data from a known child. Processing sensitive data requires the consumer's consent, meaning a clear affirmative act, so a location feature that quietly defaults on is a compliance problem in a way an analytics cookie is not.

Our consent tool has an Accept All button and a Preferences link. Is that fine?

That specific pairing is the example California's regulations use to illustrate a choice that is not equal or symmetrical, because the consumer can accept in one step but must take additional steps to decline. The regulation offers "Accept All" and "Decline All" as the symmetrical alternative, and it also treats a more prominent yes button, whether larger or in a more eye-catching color, as non-compliant. If you are running a banner you were not required to run, this is the configuration most likely to turn a voluntary control into an actual finding.