Consentinel

Global Privacy Control: which states require it.

At least twelve US states now require websites to treat the Global Privacy Control signal as a valid opt-out of sale and targeted advertising. Here is each one, when it took effect, and what honoring the signal actually takes.

12

Twelve states now make it a legal requirement

California, Colorado, Connecticut, Montana, New Hampshire, Texas, Nebraska, New Jersey, Minnesota, Delaware, Oregon, and Maryland. Colorado was the first to write it into statute in 2024. Five more turned it on in 2025, and three more in 2026.

In each, a visitor whose browser sends the signal has opted out of the sale of their data and targeted advertising, with no click required.

See every state, date, and source

Sources

45%

Fewer than half of sites comply

Researchers at Wesleyan and Princeton crawled 11,708 US websites and checked whether sites legally required to honor Global Privacy Control actually stopped sharing data when it was on. 45% did.

The usual cause isn’t a missing banner. It’s tags that never hear the visitor's choice.

Sources

$1.55M

The largest CCPA settlement at the time

California's Attorney General tested Healthline.com's opt-out and found trackers kept running after visitors said no. Healthline paid $1.55 million and agreed to three years of compliance reporting.

Its own explanation: its privacy compliance vendor "may not have properly identified and blocked all relevant online trackers" after a visitor opted out. The banner worked. The trackers didn’t listen.

Sources

Last reviewed October 4, 2026. This is a reference, not legal advice.

The states

StateLawRequired sinceSource
CaliforniaCalifornia Consumer Privacy Act, as amended by the CPRARecognized since 2021California Attorney General
ColoradoColorado Privacy ActJuly 1, 2024Colorado Attorney General
ConnecticutConnecticut Data Privacy ActJanuary 1, 2025Connecticut Attorney General
MontanaMontana Consumer Data Privacy ActJanuary 1, 2025State statute
New HampshireNew Hampshire Privacy Act, RSA 507-HJanuary 1, 2025State statute
TexasTexas Data Privacy and Security ActJanuary 1, 2025State statute
NebraskaNebraska Data Privacy ActNarrower than other states. Check the statute for how it applies to you.2025State statute
New JerseyNew Jersey Data Privacy ActJuly 15, 2025NJ Division of Consumer Affairs
MinnesotaMinnesota Consumer Data Privacy ActJuly 31, 2025State statute
DelawareDelaware Personal Data Privacy ActJanuary 1, 2026Delaware Department of Justice
OregonOregon Consumer Privacy ActJanuary 1, 2026Oregon Department of Justice
MarylandMaryland Online Data Privacy ActApplies to processing from April 1, 2026. Some practitioners read the signal requirement as less explicit than other states'.April 1, 2026State statute

States with a comprehensive privacy law but no signal requirement yet include Virginia, Utah, Iowa, Indiana, Tennessee, and Kentucky. Laws change; confirm against the current statute before relying on a date.

The enforcement record

  • Sephora paid $1.2 million in 2022 to settle California's claim that it failed to process opt-outs sent through Global Privacy Control, the first enforcement action built on the signal. California Attorney General
  • Healthline paid $1.55 million in 2025, at the time the largest CCPA settlement, after trackers kept running for visitors who had opted out. California Attorney General
  • California, Colorado, and Connecticut ran a joint sweep in September 2025 targeting businesses that don’t honor Global Privacy Control. California Privacy Protection Agency
  • Fewer than half of sites that must honor it actually do. A Wesleyan and Princeton study of 11,708 US sites found 45% compliance. USENIX Security 2025

What honoring it actually takes

Most sites that fail aren’t ignoring the law. Their consent platform reads the signal correctly, and some tags never hear about it.

  • Tags wired outside the consent gate. A pixel added straight to the theme or a tag manager without a consent check fires no matter what the banner decided.
  • Tags loaded by other tags. One ad tag can trigger cookie syncs with a dozen partners. Gating the partners does nothing if the tag that loads them still runs.
  • Platform signals that never get passed along. On Shopify, the consent app has to tell Shopify's Customer Privacy API the visitor opted out, or Shopify sets its own marketing cookies anyway.

Check whether your site honors it.

Consentinel loads your page with Global Privacy Control on and reports every tracker that fired anyway, with the request that proves it.

Free. No account. Results in about a minute.