Open workspace

Guide · United States

Privacy in the US: what a site with ads needs to know

The United States has no single federal privacy law. Each state has been creating its own, almost all of them on the opt-out model: ads can run, but the visitor has the right to say no. This guide explains that model, California, the GPC and GPP signals and how Google treats US states.

Audit my site nowRead the guide
  • ✓Based on official sources from California, Colorado, Connecticut and Virginia
  • ✓Overview with links to each state's guide
  • ✓Reads the site without changing anything
45 daysVirginia's deadline to respond to requests, extendable once
100,000consumers or households, one of the thresholds in California's law
$7,988maximum fine per intentional violation in California in 2025
2023year the first state laws after California took effect

Overview

A patchwork, not a single law

The United States does not have a general federal privacy law like the GDPR or the LGPD. At the federal level there are laws by sector and by audience. The most important for a site with ads are the Federal Trade Commission Act (FTC Act), which prohibits deceptive and unfair practices, and COPPA, which protects data of children under 13.

In practice, this means the privacy policy must tell the truth. If the site says it does not share data and passes it to ad networks, the FTC can treat that as a deceptive practice. And if the content is aimed at children, personalized ads are off the table.

The space left by the federal level has been filled by the states. California opened the way with the CCPA, and since 2023 a growing list of states has passed comprehensive consumer privacy laws. Each law has its own scope thresholds, deadlines and details, but almost all follow the same design.

Checklist

What you need to meet

Each state has its own details, but these obligations appear in most laws and in Google's rules.

  1. Offer an easy way to opt out

    Anyone who does targeted advertising or sells data must show clearly how the visitor opts out. In California, the link goes in the header or footer of the home page.

    Example

    Footer of every page: Do Not Sell or Share My Personal Information

  2. Treat GPC as an opt-out

    California, Colorado since July 1, 2024 and Connecticut since January 1, 2025 require accepting Global Privacy Control as an opt-out request. The visitor does not need to click anything.

  3. Pass the opt-out to Google

    Google turns on restricted data processing, RDP, when it receives the opt-out through the GPP string or the tag itself. With RDP, that visit gets only non-personalized ads.

    // GPT: liga o processamento restrito de dados (RDP)
// para quem recusou a venda ou a publicidade direcionada
googletag.cmd.push(function () {
  googletag.pubads().setPrivacySettings({
    restrictDataProcessing: true
  });
});

  4. Keep the privacy policy complete

    Virginia, Utah and Colorado require the policy to say which data you process, for what, with which types of third parties, and how the visitor exercises their rights.

    Example

    We use cookies from ad partners to show ads based on your browsing. To opt out, use the Do Not Sell or Share My Personal Information link in the footer.

  5. Ask permission before using sensitive data

    Virginia, Colorado and Connecticut require consent for data such as health, religion and sexual orientation. In Utah, a clear notice and a chance to opt out beforehand are required.

  6. Respond to requests on time

    Access, correction or deletion requests get a response within 45 days in California, Virginia, Colorado, Connecticut and Utah, with one extension of another 45. In California, an opt-out must be honored within 15 business days.

  7. Take care with minors

    In California, selling or sharing data of someone you know is under 16 requires prior authorization. Under 13, the authorization comes from the parents.

  8. Review your ad partners

    In AdSense and Ad Manager, the Review your ad partners control, in Privacy & messaging, defines which buyers can serve ads in the states with a law.

    Example

    Privacy & messaging > US state regulations > settings icon > Review your ad partners

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP for US states. It says that using GPP or a CMP is not mandatory, but the visitor's opt-out must reach the ads. These are the official paths.

The state model

Opt-out: ads can run, but people can say no

In Europe, the default is to ask permission first. In US states, the default is to allow and give the visitor an easy way to refuse.

Targeted advertising

The visitor can refuse to have their data used for ads based on what they do on other sites and apps.

Sale or sharing

The visitor can refuse the sale of their data. In California, this includes sharing for cross-context behavioral advertising.

Sensitive data

Health, racial origin, religion, sexual orientation and precise location have extra protection. In several states they require consent, and in California the visitor can limit their use.

Automatic browser signal

California, Colorado and Connecticut, among others, require honoring opt-out signals sent by the browser, such as Global Privacy Control.

California

CCPA and CPRA: the law that serves as a reference

The California Consumer Privacy Act (CCPA) was expanded by Proposition 24, approved in November 2020, known as the CPRA. It applies to for-profit companies that do business in California and meet at least one of these thresholds.

Revenue

Annual gross revenue of $26,625,000 or more in the prior year, a value adjusted for inflation from January 1, 2025.

Volume of people

Buying, selling or sharing data of 100,000 or more California residents or households. A site with a lot of US traffic can get there.

Revenue from data

Getting 50% or more of annual revenue from selling or sharing personal data of California residents.

Opt-out link

Those who sell or share need a clear link, usually in the footer, with the text Do Not Sell or Share My Personal Information, Your Privacy Choices or Your California Privacy Choices.

The other states

Which states already have comprehensive laws

After California, the first laws to take effect were Virginia's, on January 1, 2023, and those of Colorado and Connecticut, on July 1, 2023. Utah came next, with a leaner law.

The list continued with Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland. The laws of Indiana, Kentucky and Rhode Island took effect on January 1, 2026.

The thresholds change from state to state. In Virginia, for example, the law reaches those who process data of at least 100,000 consumers in the year, or of 25,000 consumers with more than half of revenue coming from the sale of data. In Colorado, the threshold is 100,000 consumers, or revenue from the sale of data of 25,000 or more.

Since each state has its own details, ConsentMode has separate guides for the main ones. This page gives the overview. The practical rule is to set up the site once to the strictest model and apply the opt-out for all states with a law in effect.

Rights

The rights that repeat in almost all laws

The names vary, but the set of rights is quite similar from one state to another.

Know and access

Ask what data the company has and what it uses it for.

Fix

Ask for wrong data to be corrected.

Delete

Request deletion of the data, with some exceptions provided by law.

Portability

Receive a copy of the data in a format that can be taken to another service.

Opt out

Say no to targeted advertising, the sale of data and certain types of profiling.

Appeal

In several states, challenge the company's refusal and ask for a new review. Response deadlines are short: in Virginia, 45 days to handle requests, extendable once.

Signals

GPC and GPP: the two signals the site needs to understand

Global Privacy Control (GPC) is a signal the browser itself sends, in browsers such as Firefox, Brave and DuckDuckGo or through an extension. It works like a stop selling or sharing my data button. California requires companies to honor this signal as a valid opt-out request.

In Colorado, accepting universal opt-out mechanisms became mandatory on July 1, 2024, and GPC was the first one recognized by the state. In Connecticut, the obligation has applied since January 1, 2025. In other words: a visitor with GPC turned on must be treated as if they had clicked the opt-out link.

Global Privacy Platform (GPP) is something else. It is the format created by the IAB Tech Lab for the CMP to pass the visitor's choice to all ad partners, with sections for US states. It replaces the old US Privacy string, which the IAB discontinued in January 2024.

Summary: GPC is the request that comes from the browser. GPP is the way for the CMP to tell Google and the other networks what the visitor chose.

Timeline

How the US map took shape

Dates confirmed in each state's official sources.

  1. November 2020

    Proposition 24 in California

    Voters approve the CPRA, which expands the CCPA and creates the state privacy agency (CPPA).

  2. January 1, 2023

    CPRA and Virginia

    California's new protections and Virginia's law take effect. Google expands restricted data processing to state laws.

  3. July 1, 2023

    Colorado and Connecticut

    Both laws take effect with the right to opt out of targeted advertising.

  4. January 2024

    End of the US Privacy string

    The IAB discontinues the US Privacy string in favor of GPP.

  5. July 1, 2024

    Universal opt-out in Colorado

    Companies must now accept signals such as GPC.

  6. January 1, 2025

    Connecticut and new amounts in California

    Connecticut starts requiring respect for opt-out signals. California adjusts thresholds and fines for inflation.

  7. January 1, 2026

    Indiana, Kentucky and Rhode Island

    Three new state laws take effect. In California, rules on automated decisions, risk assessments and audits take effect.

AdSense and Ad Manager

How Google treats US states

Google has offered restricted data processing (RDP) since 2019, created for the CCPA, and expanded it in January 2023 to state laws. With RDP on, Google limits the use of identifiers and serves only non-personalized ads for that visit.

RDP can be turned on in three ways: through a CMP that sends the GPP signal, through a setting on each ad request in the site's tag, or for all traffic from the applicable states in the Privacy & messaging settings. The per-request setting combines well with an opt-out link in the footer.

In AdSense and Ad Manager there is also the Review your ad partners control, under US state regulations, to choose which buyers can serve ads to users in those states. Google recommends migrating from the US Privacy string to GPP, although it still reads the old string for compatibility.

Unlike Europe, Google does not require a certified CMP for the United States. But the publisher remains responsible for offering the opt-out required by state laws and for keeping the privacy policy correct.

What to do

How to set up a site with US traffic

  1. Measure traffic by stateSee in Analytics how many visitors come from California and the other states with a law. This helps you know which thresholds the site may reach.
  2. Update the privacy policyExplain what data the ads use, which partners receive it, what rights the visitor has and how to exercise them, citing the applicable state laws.
  3. Put the opt-out link in the footerUse an accepted text, such as Do Not Sell or Share My Personal Information or Your Privacy Choices, leading to a page or message that really works.
  4. Honor GPCSet up the CMP or the site to treat the GPC signal as an automatic opt-out, without asking the visitor for anything more.
  5. Pass the choice to GoogleUse GPP through the CMP, per-request RDP or the US states message in Privacy & messaging.
  6. Review your partnersIn AdSense or Ad Manager, check under US state regulations which partners can serve ads in those states.

In practice

What is and is not allowed for US visitors

Examples based on the opt-out model of state laws.

Allowed

  • Showing personalized ads by default, offering a clear opt-out
  • Using a Your Privacy Choices link in the footer of all pages
  • Turning on Google RDP only for those who opted out or for states with a law
  • Treating GPC as an opt-out without opening any banner
  • Using the same opt-out page for all states with a law
  • Sending the choice to partners through the GPP string

Not allowed

  • Opt-out link that leads to a page with no real action
  • Requiring signup or login for the visitor to opt out
  • Ignoring the GPC signal from California visitors
  • Continuing to send data for remarketing after the opt-out
  • Showing the European TCF message to a US audience
  • Targeting personalized ads at content for children under 13

In ConsentMode

What the audit checks for US visitors

  • Opens the site as a California visitor and shows in a screenshot whether the opt-out link appears and where it leads.
  • Repeats the visit with the GPC signal on and checks whether the site and tags change behavior.
  • Reads the GPP string or the old US Privacy string in the page code and identifies the CMP.
  • Checks whether ad requests carry the restricted processing signal after the opt-out.
  • Reads the privacy policy and points out whether rights, partners or state laws are missing.
Run an auditSee everything that is checked

Frequently asked questions about US laws

My site is Brazilian. Do US laws apply to me?

They may, if the site does business with residents of the state and meets the law's thresholds, such as the volume of California visitors. Each law has its own criteria. When in doubt, offering the opt-out and honoring GPC is a simple and safe setup.

Do I need a cookie banner for the US?

As a rule, not in the European format. The US model asks for an opt-out link and transparency in the privacy policy. For sensitive data, some states ask for consent.

What happens to revenue when I turn on RDP?

Visits with RDP receive only non-personalized ads, which usually pay less. So the ideal is to turn on RDP for those who opted out, and not for all traffic in the world.

What is the difference between GPC and GPP?

GPC is the signal the visitor's browser sends saying do not sell my data. GPP is the format the CMP uses to pass the visitor's choice to ad networks.

What are the fines in California?

Since January 1, 2025, up to $2,663 per violation and up to $7,988 per intentional violation or one involving minors under 16. Other state laws have their own amounts, such as up to $7,500 per violation in Virginia.

Where do I find the details for each state?

ConsentMode has separate guides for the main states. This page summarizes what they have in common and what changes at Google.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Test your site's opt-out as a US visitor

The audit checks the opt-out link, GPC, GPP and signals sent to Google, and shows what to fix.

Start the audit