Cookie Banners and US State Privacy Laws: What a Small Business Website Actually Needs

Cookie banners have become so common that many small business owners assume they are legally required everywhere. In the U.S., that's not quite how it works. Most state privacy laws are built around opting out, not opting in, and the thing regulators are actually checking is whether your website honors people's choices, including automatic signals sent by their browser.

This guide explains what a typical small business website needs in 2026, with a focus on California, where most of the enforcement has happened. It's general information, not legal advice; if your situation is close to a line, talk to a privacy attorney.

First: do these laws apply to you?

The California Consumer Privacy Act (CCPA) applies to for-profit businesses that do business in California and meet at least one of these thresholds (California Privacy Protection Agency):

• Annual gross revenue over $26,625,000 (the inflation-adjusted figure in effect since January 1, 2025)
• Buys, sells or shares the personal information of 100,000 or more California consumers or households a year
• Earns 50% or more of annual revenue from selling or sharing personal information

Roughly twenty states, California included, now have comprehensive consumer privacy laws, each with its own thresholds. Many are based on how many state residents' data you handle (often 100,000, or lower if you sell data), while a few, such as Texas and Nebraska, don't use a consumer-count threshold at all and instead exempt businesses that qualify as small under federal SBA standards.

Two cautions. First, the 100,000 count includes website visitors, not just customers, and ad pixels count those too. Second, even if you fall under the thresholds, your clients, partners and lenders may expect you to follow the same practices, and California's separate wiretapping law has been used to sue websites of all sizes over tracking tools.

The part people miss: “selling” and “sharing” include ad tracking

Under the CCPA, “sharing” covers giving personal information to a third party for cross-context behavioral advertising. That's what many ad and retargeting pixels do. In California's first CCPA settlement in 2022, the Attorney General said Sephora's use of third-party tracking on its site counted as a sale and that it failed to honor opt-out requests sent through Global Privacy Control; the company paid $1.2 million (California Attorney General).

So if your site runs ad pixels, retargeting or similar third-party tracking, assume you are probably “selling or sharing” for privacy-law purposes and build your setup around that.

What Global Privacy Control is

Global Privacy Control (GPC) is a setting in some browsers and extensions that tells every website “don't sell or share my data.” Technically, it arrives as a Sec-GPC: 1 header and a navigator.globalPrivacyControl value your site can read (globalprivacycontrol.org).

California's regulations require a business that collects personal information online and sells or shares it to accept opt-outs through an opt-out preference signal like GPC, plus at least one other method (Cal. Code Regs. tit. 11 § 7026). Several other states, including Colorado, Connecticut, Texas and Oregon, also require businesses covered by their laws to honor universal opt-out signals.

The browser side is about to grow. California's Opt Me Out Act (AB 566), signed in October 2025, requires web browsers to offer a built-in setting to send an opt-out preference signal starting January 1, 2027 (CPPA). Expect many more of your visitors to send GPC.

Why a cookie banner alone isn't enough

California's rules say it plainly: a cookie banner or cookie controls are not by itself an acceptable way to opt out of sale or sharing, because cookies concern the collection of data, not its sale or sharing (§ 7026(a)(4)). Recent enforcement backs this up:

• Healthline (July 2025, $1.55 million): the Attorney General alleged that advertising trackers kept running even after visitors opted out, and the settlement requires the company to process opt-outs sent through GPC (California Attorney General).
• Disney (February 2026, $2.75 million): the Attorney General alleged that opt-outs only applied to one device or service rather than the whole account, and that opt-out preference signals weren't fully honored (California Attorney General).

The pattern is consistent: regulators test whether the opt-out actually turns off the tracking, everywhere it should.

What a typical small business site needs

Your website…	What to put in place
Has no ad pixels or third-party trackers, just basic first-party analytics	A clear privacy policy. A banner is usually optional in the U.S.
Uses advertising or retargeting pixels and the CCPA (or another state law) applies	A “Do Not Sell or Share My Personal Information” link (or the “Your Privacy Choices” alternative link), GPC honored automatically, and a privacy policy explaining both
Collects sensitive data (health, precise location, etc.)	Extra limits; several states require opt-in consent before processing sensitive data
Has visitors from the EU or UK	Different rules: opt-in consent before non-essential cookies

Practical checklist

1. Inventory your tags. List every script and pixel on the site (analytics, ads, chat, video embeds, session replay) and what each sends where.
2. Cut what you don't use. Every tracker you remove is one less thing to manage and makes the site faster.
3. Add the opt-out link in your footer if you sell or share data.
4. Honor GPC automatically. When the signal is present, don't load ad and retargeting tags for that visitor, without making them click anything.
5. Show that it worked. California's updated regulations, in effect since January 1, 2026, call for businesses to display whether they've processed the signal, for example “Opt-Out Preference Signal Honored” (Freshfields).
6. Make opt-out as easy as opt-in. No extra verification, no account required, and “reject” as visible as “accept” if you use a banner.
7. Test it. Turn on GPC in a browser that supports it, visit your site, and check with your web person that the ad tags really don't fire.
8. Update your privacy policy to match what the site actually does, and review it at least once a year.

Common mistakes

• Installing a banner plugin and assuming the job is done, while ad tags still load before anyone clicks anything.
• An opt-out link that leads to a general contact form or an email address that nobody checks.
• Honoring GPC on the main site but not on landing pages, booking widgets or subdomains run by other vendors.
• A privacy policy copied from a template that mentions tools you don't use and leaves out the ones you do.

What's still changing

Privacy rules are moving quickly. California's privacy agency has proposed further changes to its opt-out preference signal rules that would name Global Privacy Control explicitly; at the time of writing those are on its board's agenda and not final (Freshfields). More states' laws take effect each year, too. Building your site to honor GPC by default keeps you on the right side of most of them at once.

Getting it set up

Right On Tech builds and maintains websites for small and mid-size businesses in Los Angeles and the San Fernando Valley. We can audit the trackers on your site, remove what you don't need, and set up opt-out links and GPC handling that actually work. Contact us or call (818) 456 0303.