Privacy ComplianceConsent Banners
Opt-In or Opt-Out? Choosing a Consent Default in the United States
One of the most important decisions in a web consent setup is whether non-essential tracking fires by default. Some parts of the world, like the European Union, have already settled this by law. In the United States, it is a risk-based business decision, and many businesses have not made it deliberately.
By Alex Proctor
Published September 10, 2026
Summary
In the United States, modern state privacy laws tend to allow web tracking by default and are most concerned with the availability of opt-out pathways. However, some wiretapping case law suggests that retroactive consent is invalid. Because most visitors do not interact with consent banners, the default setting has major implications on analytics and marketing data. Opt-in is the more defensible position, but can severely reduce collection. Opt-out preserves most of it, but carries residual CIPA exposure. Either approach, or a hybrid, can be a legitimate choice if it is made thoughtfully.
Opt-In vs. Opt-Out Models
A consent management platform (CMP) supports two primary models. Under the opt-in model, non-essential technologies never run unless the user affirmatively consents to them. Under the opt-out model, non-essential technologies run by default, until the user rejects tracking.
It is not necessary to make a binary, worldwide choice. In fact, most global companies do not apply a single model universally. A worldwide opt-in approach reduces privacy risk substantially but can severely impact analytics and marketing. A worldwide opt-out approach is less disruptive commercially but fails to meet the law in jurisdictions that mandate opt-in consent.
A typical approach involves geolocation-based default settings, in which the opt-in model is used where it is required and the opt-out model is used elsewhere.
Why Does the Default Setting Matter?
You may be surprised to learn that most visitors do not interact with consent banners. In my experience, it is common for more than 95 percent of website visitors to make no privacy choice at all. As a result, the default settings tend to stick.
Under an opt-out model, non-essential trackers fire on page load, and the impact on analytics is minimal, often less than 5 percent. Under an opt-in model, nothing non-essential fires until someone affirmatively consents, so data collection can drop by 95 percent or more. For this reason, default consent settings should be a leadership decision, not just a privacy team decision.
The Two Models Side by Side
| Factor | Opt-out model | Opt-in model |
|---|---|---|
| Default behavior on first load | All trackers fire before the visitor makes a choice | Only essential trackers fire until the visitor consents |
| If the visitor never interacts | Default stays in place, so tracking continues | Default stays in place, so tracking never starts |
| Impact on analytics and marketing data | Very low, often less than a 5 percent loss | Very high, often a 95 percent loss or more |
| Regulatory compliance (EU/UK) | Not permissible for non-essential tracking | Required for non-essential tracking |
| Regulatory compliance (US) | Generally permissible under the modern state laws | Permissible, and required for sensitive data |
| Private litigation exposure (US) | Residual CIPA exposure under some case law | Minimal, because nothing fires before consent |
Impact estimates are based on my personal observations across many environments.
Where the Law Stands in the United States
The modern state privacy laws are built around the opt-out model. At a minimum, they require a way to decline the sale or sharing of personal information and targeted advertising, and many states also require businesses to honor the Global Privacy Control opt-out signal.
These laws generally do not require consent before non-essential tracking begins, except where the tracking data could constitute "sensitive" personal data, which most of these laws treat as an opt-in category. A simple example is a healthcare website, where an accessed URL could be used to infer a health condition about the visitor. In cases like this, consent should be obtained prior to non-essential tracking and data sharing.
The complication is that substantial private litigation depends on older wiretapping and interception statutes with private rights of action. In Javier v. Assurance IQ, the Ninth Circuit held that consent under CIPA must exist before recording begins. According to this case law, retroactive consent is invalid.
Under an opt-out default, trackers fire before the visitor has made any choice, which is the behavior that can lead to CIPA litigation risk. So it is possible for an opt-out model to satisfy the newer statutes without eliminating litigation exposure under the older ones.
Making the Decision
Selecting a US consent default requires a risk assessment, and is not purely a compliance question. From a pure litigation defense standpoint, opt-in is the clean position. Nothing non-essential runs until someone agrees to tracking, so there are no pre-consent network requests for a plaintiff to point to.
If you choose the opt-out model to preserve analytics and marketing, that can be a legitimate choice too. Many organizations do. Just make it carefully with counsel, knowing the residual CIPA exposure that exists under the opt-out model.
Two conditions apply to either choice. The banner has to enforce the model it presents. An opt-out consent platform that does not stop trackers, or an opt-in configuration that leaks a tracker before the opt-in, is highly risky and likely to be targeted by privacy litigators. Many sites I review are in that tenuous position without knowing it. Your website's privacy notice also has to accurately describe how consent decisions are handled.
Questions
Is an opt-out consent model legal in the United States?+
Generally yes. The modern state privacy laws require a working way to opt out of the sale or sharing of personal information and of targeted advertising, and many require honoring the Global Privacy Control signal. They do not require consent before non-essential tracking begins. The pressure toward opt-in defaults comes mostly from wiretapping case law, not from the privacy statutes.
Can a site use opt-in in some states and opt-out in others?+
Yes, and a state-level hybrid is common. Some companies apply the opt-in model to visitors from states with elevated wiretapping litigation risk, such as California, Florida, and Pennsylvania, and the opt-out model everywhere else. Some consent platforms, including Captain Compliance, support this through geolocation-based configuration options.
If almost nobody clicks the banner, does the banner matter?+
Yes. The banner's default setting is what the site does for nearly every visitor, so it matters more than the click rate suggests. For the few who do click, the site has made a promise it has to keep. A banner that offers a choice and does not enforce it adds a misrepresentation claim to the tracking claim.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.