Privacy ComplianceConsent Banners
Is a Cookie Banner Required in the U.S.? Why Most Websites Still Need One
Most U.S. websites that use advertising or analytics tools need a cookie banner, even though no law requires one explicitly. State privacy laws require a way to opt out of certain web tracking. Wiretapping lawsuits may also turn on whether a visitor consented to tracking. A working consent banner is the most practical way to address both.
By Alex Proctor
Published October 5, 2026
Summary
State privacy laws require covered businesses to let consumers opt out of the sale of personal information and targeted advertising. Twelve states also require websites to honor opt-out signals such as the Global Privacy Control (GPC). Separately, wiretapping laws such as the California Invasion of Privacy Act (CIPA) apply to websites of any size, with consent as a main defense. A banner addresses both concerns only if it controls the tracking tools operating on the website. In California, it should integrate with requests to opt out of the sale and sharing of data.
What Do State Privacy Laws Require?
About 20 states have comprehensive privacy laws. None of them requires a website consent banner explicitly, but they do contain requirements that, when taken together, imply that such technology is necessary. For example, these laws require a business to tell consumers what it collects and to let them opt out of the sale of personal information and targeted advertising. (In addition to advertising, the use of analytics tools can count as a sale, so a website that uses them may need an opt-out path too.)
In California, Civil Code section 1798.135 requires a business that sells or shares personal information to post a "Do Not Sell or Share My Personal Information" link, unless it honors opt-out preference signals in a way that makes the link unnecessary. Twelve states now require websites to honor opt-out signals such as the GPC, and two more will by 2028.
However, California's regulations say a banner alone does not satisfy the opt-out requirement. Section 7026 states that a cookie banner "is not by itself an acceptable method for submitting requests to opt-out of sale/sharing." A consent banner typically needs to be a part of the solution, but the opt-out has to stop the sale and sharing of data broadly, which is not exclusive to cookies and web tracking.
Why Does Litigation Make a Banner Even More Necessary?
With a couple of exceptions, state privacy laws apply only to businesses above certain size thresholds. In California, the main thresholds are annual revenue above an inflation-adjusted $25 million or personal information from 100,000 or more consumers. In contrast, wiretapping laws such as CIPA have no thresholds, so they can be applied to a small online store the same way they apply to a national retailer.
Wiretapping claims tend to allege that advertising and analytics tools let third parties intercept a visitor's activity without consent. Consent is one of the main defenses, and courts look at whether the banner works correctly and whether consent was obtained before the tracking began. A consent banner is the practical mechanism for websites to ask for consent and keep a record of the visitor's interaction.
Notably, a banner only helps if it actively controls the web tracking tools behind it. A banner that offers a choice that the tracking does not respect can add a misrepresentation claim to the tracking claim.
What Does a Working Consent Banner Do?
The table lists what a consent banner has to do to address web tracking risks.
| What the banner does | Why it matters |
|---|---|
| Gives a top-level notice about tracking | Visitors have to be told at or before collection |
| Blocks tracking tools when a visitor declines | A choice the tracking ignores can add a claim |
| Honors opt-out signals such as the GPC | Twelve states require it |
| Passes each choice to platform consent tools | Platforms apply a choice only if they receive it |
| Records each visitor's consent status | It is the evidence of consent in a dispute |
| Presents choices with equal prominence | Dark patterns can invalidate consent |
Based on state privacy laws and recent wiretapping complaints, as of October 2026.
Does a Banner Have to Use the Opt-In Model by Default?
This is a larger question than it appears, and it has no easy answer in the United States. State privacy laws generally permit an opt-out model, in which tracking runs until a visitor declines. However, some wiretapping case law holds that consent has to exist before tracking begins, which points toward an opt-in model.
As a result, choosing between opt-in and opt-out is a risk decision for the leadership of any company that uses these tools. An opt-in default provides stronger protection against wiretapping claims. However, most visitors never interact with a banner, so it can reduce advertising and analytics data by 95 percent or more. An opt-out default preserves that data but leaves the company more exposed to litigation.
Under either model, the banner has to present its choices fairly. Regulators have treated dark patterns, such as a prominent "Accept" beside a hidden "Decline," as invalidating the consent the banner collects.
What Does This Mean for Your Website?
I recommend starting with an inventory of the tools a website loads. If any of them send visitor data to advertising or analytics vendors, the website needs to give notice, enforce each visitor's choice, honor the GPC, and keep a record. A consent banner backed by a consent management platform is the most practical way to do all four.
A website that loads only essential tools, such as a shopping cart, a login, or fraud prevention, may not need a banner. However, that is worth confirming rather than assuming, because third-party tools are often added by marketing teams, plugins, and embedded content without a privacy review.
The notice and consent model is far from beloved. Visitors find banners tedious, and most never interact with them. Browser signals such as the GPC may reduce the need for banners over time, once California requires browsers to offer one in 2027. However, there is no practical alternative today for a website that uses these tools.
Questions
Does a small business need a cookie banner?+
Usually, if it uses advertising or analytics tools. Most state privacy laws apply only above size thresholds, so many small businesses are not covered by them. However, wiretapping laws such as CIPA have no thresholds, and small online stores have been named in recent lawsuits over these tools. A small business that uses them has the same reason to collect and enforce consent as a large one.
Is a cookie banner enough to comply with California's opt-out rules?+
Not by itself. California's regulations say a cookie banner is not an acceptable method for opt-out requests on its own. Many businesses sell or share data beyond the scope of web tracking, so the opt-out has to reach that data too, including data handled offline. A business also needs a "Do Not Sell or Share My Personal Information" link or a process that honors opt-out preference signals for any sale and sharing of data.
Do U.S. websites need a cookie banner for European visitors?+
Generally, yes. A U.S. website that offers goods or services to people in the EU or UK is subject to European rules, which require opt-in consent before non-essential cookies are placed. Some businesses handle this by showing an opt-in banner to European visitors while using a different consent model in the United States.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.