US data privacy regulations for digital marketing

The United States has no single data privacy law. It has 19 state laws in effect, two more signed for 2027, a federal regulator that enforces through unfair-practice cases, and a handful of sector rules for health, children, and phone calls. For a marketing team, that long list comes down to three questions: when does an ad pixel count as a “sale” of personal data, what happens when a visitor opts out, and which data needs consent before you collect it at all.

This guide answers those three questions as the rules stand in October 2026, with the enforcement cases that show what regulators actually check. The short version: the US model is opt-out, not opt-in. Nobody requires a cookie banner. Everybody requires that an opt-out works, on every device, all the way down to the last tag.

What “data privacy regulations” means in the US

US data privacy regulations are a patchwork: state consumer privacy laws that give residents rights over their personal data, federal enforcement by the Federal Trade Commission under Section 5 of the FTC Act, and sector laws such as COPPA, HIPAA, and the TCPA. There is no federal law equivalent to GDPR. The last comprehensive bill, the American Privacy Rights Act, died in 2024; its successor, the SECURE Data Act, had a House subcommittee hearing in June 2026 and no vote since.

For digital marketing, the state laws matter most. They define what a sale or a share of personal data is, give consumers the right to opt out of targeted advertising, and increasingly require that an opt-out sent by the browser be honored automatically.

The 19 state privacy laws in effect

Nineteen states have comprehensive consumer privacy laws in force, after Indiana, Kentucky, and Rhode Island joined on January 1, 2026. Oklahoma (January 1, 2027) and Alabama (May 1, 2027) are signed and coming. Most follow the Virginia model; California is its own thing.

Three things to read across the table:

• Thresholds are falling. The Virginia model applies at 100,000 consumers a year. Maryland and Rhode Island start at 35,000, Montana at 25,000, and Connecticut drops to 35,000 in July 2026. Texas has no volume threshold at all, only a small-business exemption. California applies above $25 million in revenue, or at 100,000 consumers, or when half your revenue comes from selling or sharing data.
• Cure periods are disappearing. California never had one under the CPRA. Colorado, Connecticut, Delaware, Oregon, Montana, and Minnesota have let theirs expire, and New Jersey’s ended in July 2026. A first violation can now be a fine, not a warning.
• GPC is the default. Twelve of the nineteen require you to honor an opt-out preference signal sent by the browser. In practice that signal is Global Privacy Control.

When an ad pixel is a “sale” or a “share”

This is the definition that decides whether your Meta Pixel, Google Ads tag, or TikTok pixel needs an opt-out. Under the CCPA, a sale is disclosing personal information to a third party “for monetary or other valuable consideration,” and a share is disclosing it “for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.” Cross-context behavioral advertising means targeting ads based on activity across other businesses’ sites and apps.

The Virginia-model states say the same with different words: targeted advertising is ads selected from a consumer’s activity “over time and across nonaffiliated websites or online applications.” First-party data, contextual ads, and ad measurement are excluded.

What that means per tag:

• Ad pixels and conversion APIs send identifiers to a platform that uses them for its own targeting across sites. That is sharing in California and targeted advertising elsewhere. They need a working opt-out, and they must stop when a visitor opts out.
• Analytics vendors can be service providers (California) or processors (everywhere else), as long as the contract limits what they do with the data. The CPPA fined Honda in March 2025 and Tractor Supply in September 2025 partly because their ad-tech contracts lacked the required terms.
• Hashed emails and audience matching are still personal data. Whether uploading them is a sale depends on whether the platform uses them for its own purposes. No regulator has issued guidance that says otherwise, so treat it as a share.

Global Privacy Control is where enforcement happens

Every CCPA enforcement action since 2022 has involved an opt-out that did not work. The pattern is consistent enough to be a checklist:

• Sephora, August 2022, $1.2 million (California AG): did not honor GPC, and sold data through third-party cookies.
• Honda, March 2025, $632,500 (CPPA): asked for more information to opt out than to opt in, and its cookie tool was not symmetrical.
• Todd Snyder, May 2025, $345,178 (CPPA): the consent banner failed to process opt-outs for 40 days, and required ID to opt out.
• Healthline, July 2025, $1.55 million (California AG): kept sharing with ad vendors after opt-outs, including those sent through GPC, and its banner did not disable the cookies it claimed to. It also sent article titles that revealed diagnoses.
• Tractor Supply, September 2025, $1.35 million (CPPA): no working opt-out, GPC included; the order requires it to scan its sites and inventory its tracking technologies.
• Disney, February 2026, $2.75 million (California AG): opt-outs and GPC applied to one device or service only, not to the whole account.
• Ford, March 2026, $375,703 (CPPA): required email verification before an opt-out.
• General Motors, May 2026, $12.75 million (California AG and county district attorneys): sold driving and location data to data brokers.

In September 2025, California, Colorado, and Connecticut ran a joint GPC sweep and sent letters to companies whose sites ignored the signal. The regulators are not reading privacy policies. They are opening a browser with GPC on, visiting the site, and watching which requests still go out.

Sensitive data, health data, and minors

The opt-out model has three exceptions where consent comes first.

Sensitive data needs opt-in consent in Virginia and every state that follows its model: precise geolocation, health, race, religion, sexual orientation, biometrics, and data about a known child. California, Utah, and Iowa use a right to limit instead of consent. Maryland goes furthest: it bans selling sensitive data outright and limits collection to what is “strictly necessary” for the service the consumer asked for. Oregon bars selling location data precise to a 1,750-foot radius from January 2026.

Health data has its own law in Washington. The My Health My Data Act requires opt-in consent to collect or share consumer health data, a separate signed authorization to sell it, and bans geofencing near care facilities. A violation is an unfair or deceptive act under the state’s consumer protection law, which gives individuals a private right of action. The first class action, against Amazon’s ads SDK, was filed in February 2025. In a related California case, a jury found Meta liable in August 2025 for receiving health data from the Flo app through its SDK.

Minors are protected regardless of consent in some states. Maryland bans targeted advertising and sale where the controller “knew or should have known” the consumer is under 18. Oregon does the same for under-16s from January 2026, with no consent exception. Colorado, Delaware, and New Jersey require consent for 13-to-17-year-olds. Federally, the amended COPPA rule took effect in June 2025, with a compliance date of April 22, 2026, and requires separate verifiable parental consent before disclosing children’s data to third parties for targeted advertising.

The federal layer: the FTC checks what your pixels send

The FTC does not need a privacy law to act. It uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, and it has made tracking pixels a recurring target. GoodRx (2023, $1.5 million) and BetterHelp (2023, $7.8 million) were penalized for sending health data to Meta, Google, Criteo, and others through pixels and SDKs. Premom (2023) for sending fertility data through an SDK. In July 2026, the FTC, Utah, and Los Angeles County filed a complaint against Hims & Hers that cites, among other things, health information shared through Meta Pixel and the Conversions API.

The HIPAA tracking bulletin is partly vacated: a Texas court ruled in June 2024 that an IP address plus a visit to a public health page is not protected health information, and HHS dropped its appeal. The rest of the bulletin, on authenticated pages and business associate agreements, still stands.

Do US laws require a cookie banner?

No. No state law requires a cookie banner or prior consent for ordinary cookies. The US model is opt-out: a “Do Not Sell or Share My Personal Information” link (or the alternative opt-out link), honoring GPC where the state requires it, and stopping sales, shares, and targeted advertising when a consumer asks. Consent is required only for sensitive data, for minors, and for health data under Washington’s law.

If you show a banner anyway, it has to be symmetrical. The California regulations say the privacy-protective choice “shall not be longer or more difficult” than the other one: “Accept All” next to “More Information” is a dark pattern; “Accept All” next to “Decline All” is not. Colorado has the same rule. And the banner has to do what it says. Healthline and Todd Snyder were fined for banners that showed a choice and did not apply it.

What this means for your tracking setup

The laws are enforced at the request level, so the work is at the request level too.

1. Inventory every tag, pixel, and SDK on your sites and apps, and which vendor each one sends to. Tractor Supply’s order makes this an explicit obligation.
2. Classify each vendor as a service provider or processor (analytics with a contract that limits use) or as a third party (ad platforms). The second group needs the opt-out.
3. Honor GPC end to end. Read the signal, apply it to the whole account rather than one device, and make sure the ad pixels and conversion APIs stop. Disney was fined for the device part; Healthline for the pixels.
4. Treat health, location, and minors’ data as consent-first, whatever state the visitor is in. The private right of action in Washington makes this the costliest mistake.
5. Verify after every release. A tag manager change, a new pixel, or a CMP update can undo all of the above without anyone noticing.

That last step is where a privacy review stops being a document and becomes monitoring. Trackingplan inspects every hit for PII leaks, Consent Mode misfires, and vendors firing without permission, across web, mobile, and server-side: the consent state on every hit, checked against what actually fired, per market and per platform. Findings land in your privacy channel with the hits, the vendor, the market, and the regulation involved, so the fix is a tag change, not an investigation. It observes and reports; it does not block tags or make you compliant. It tells you, on real traffic, whether the opt-out you promised is the one your visitors get.

For the California rules in depth, see the CCPA compliance requirements guide. For personal data in payloads, the guide to PII leak detection in analytics. For the audit itself, the privacy tracking audit checklist.

FAQ

What are the key privacy laws in the United States?

Nineteen state consumer privacy laws, led by California’s CCPA as amended by the CPRA; the FTC Act, which the FTC uses against unfair or deceptive data practices; and sector laws: COPPA for children under 13, HIPAA for covered health entities, and the TCPA for calls and texts. Washington’s My Health My Data Act covers consumer health data outside HIPAA.

Who does the CCPA apply to?

For-profit businesses that collect California residents’ personal information and meet one of three thresholds: more than $25 million in annual revenue, buying, selling, or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing personal information. Where the business is based does not matter.

Does the CCPA apply to other states?

No. It protects California residents. Eighteen other states have their own laws, most of them modeled on Virginia’s, with lower thresholds and opt-in consent for sensitive data. A national site has to meet the strictest rule that applies to each visitor, which is why many companies apply GPC and a working opt-out everywhere.

What is the difference between the CCPA and the CPRA?

The CPRA is the 2020 ballot measure that amended the CCPA. It took effect on January 1, 2023, added the right to opt out of sharing for cross-context behavioral advertising, the right to limit the use of sensitive personal information, removed the cure period, and created the California Privacy Protection Agency, which now enforces the law alongside the Attorney General.

Is there a federal data privacy law in the US?

Not a comprehensive one. The American Privacy Rights Act did not pass in 2024, and the SECURE Data Act introduced in April 2026 has had a hearing but no vote. Federal privacy enforcement comes from the FTC under Section 5 and from sector laws.

Sources

• California Privacy Protection Agency, CCPA statute and regulations; 2025 regulations approved; Honda, Todd Snyder, Tractor Supply, GPC sweep, Ford
• California Attorney General, Sephora, Healthline, Disney; Los Angeles County DA, General Motors
• 11 CCR § 7004, symmetry in choice
• IAPP, US state comprehensive privacy laws
• Virginia Code § 59.1-575; Delaware Code Title 6, Chapter 12D; Maryland MODPA § 14-4707; Washington RCW 19.373.090; Colorado SB 24-041
• FTC, GoodRx, BetterHelp, Hims & Hers; COPPA final rule
• House Energy and Commerce Committee, SECURE Data Act hearing

Laws change and this is not legal advice. The dates above are the ones in force on October 19, 2026; check the regulator’s site before you rely on one.