US state privacy laws (CCPA/CPRA and others)
The law as we understand it on 5 November 2026. Which law applies to you depends on thresholds (revenue, number of consumers) that differ by state. See the overview for what these pages are and are not.
What the law asks
US state laws do not ask for consent before cookies run. They ask for notice and a right to opt out: tell visitors what you collect, let them opt out of the "sale" or "sharing" of their personal information and of targeted advertising, and ask opt-in consent only for sensitive data and for minors.
California (CCPA as amended by CPRA)
- Notice at collection, at or before the moment data is collected.
- A "Do Not Sell or Share My Personal Information" link, and a "Limit the Use of My Sensitive Personal Information" link where it applies — or one "Your Privacy Choices" link with the opt-out icon instead of both.
- Opt-out preference signals. A business that sells or shares must treat a browser signal such as Global Privacy Control as a valid opt-out for that browser, without asking for anything more. Since 1 January 2026 the business must also show whether it processed the signal (for example "Opt-Out Request Honored").
- Symmetry in choice: the privacy-protective option must not be longer or harder than the other; consent obtained through dark patterns is not consent.
- After an opt-out, wait 12 months before asking the person to opt back in.
The California Privacy Protection Agency and the Attorney General enforce; fines are up to $2,663 per violation and $7,988 per intentional violation (2025 amounts).
The other states
Comprehensive privacy laws are in force in about twenty states, among them Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland; Indiana, Kentucky and Rhode Island since 1 January 2026. They differ in detail but share the opt-out of sale and targeted advertising.
Twelve states require honouring universal opt-out signals such as Global Privacy Control: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas, with start dates between 2024 and 2026. Colorado is the only state that keeps an official list, and GPC is the only mechanism on it.
IAB GPP
Ad technology reads US opt-out choices from the IAB Global Privacy Platform
(__gpp). Its US National section (usnat), from the Multi-State Privacy
Agreement, carries the opt-outs and a Global Privacy Control flag in one string.
How ConnectWiz handles it
ConnectWiz starts US visitors like everyone else — everything denied until they choose — which every US law allows. If you sell to US customers and want the notice-and-opt-out model, switch on Use the US state privacy model (opt-out) under Default before a choice, by region (see US visitors):
| The rule | In ConnectWiz |
|---|---|
| Notice at collection | US visitors see the banner once as a notice, in their language. |
| "Do Not Sell or Share" | The notice has three equal buttons: OK, Do not sell or share my personal information (marketing off, the rest kept) and Preferences. |
| "Your Privacy Choices" link | The cookie button is named Your privacy choices; any element with data-cwz-privacy-choices in your footer opens the same choices. |
| Global Privacy Control | Honoured on every site, with or without the US model: a browser that sends it never starts with marketing on, and the notice says the signal was applied. Only the visitor's own choice can turn marketing back on. |
| 12 months after an opt-out | A choice that turns marketing off is kept at least 12 months. |
| Proof | Each record says it was made under the opt-out model and whether the browser sent GPC. |
| IAB GPP | With Also send IAB GPP signals (US National) on, the page answers __gpp with a usnat string, GPC sub-section included. See IAB GPP signals. |
The whole United States gets the model: a visitor's state cannot be told from the address, and a notice and opt-out do no harm where a state has no law.
What you still need to do
- Your privacy policy must describe what you collect, the categories you sell or share, and how to opt out; the banner's notice does not replace it.
- Sensitive data and minors need opt-in consent; if your site collects them, the opt-out model is not enough for those purposes.
- Requests by e-mail or form (access, deletion, opt-out for data not tied to a browser) are yours to answer; ConnectWiz records the browser choices.
- Check whether a law applies to you — the thresholds differ by state.