---
title: Cookie Laws Across the US
description: Cookie laws in the US are similar to one another and reflect the basic principles of the GDPR, but they each have particular nuances. Stay up to date here.
image: https://blog.linksquares.com/hubfs/Copy%20of%20Legal%20Best%20Practices_Thumbnail-Nov-29-2022-01-46-54-9746-PM.png
---
[Skip to content](https://blog.linksquares.com/cookie-laws-across-the-us#main-content)
[LinkSquares](https://blog.linksquares.com/)
Open Mobile Menu
[LinkSquares](https://linksquares.com/)
Close Mobile Menu
[Why LinkSquares](https://linksquares.com/why-linksquares/) [Products](https://linksquares.com/products/)
---
[The LinkSquares Cloud One platform for all your in-house legal needs](https://linksquares.com/products/linksquares-cloud/)
---
Contract Lifecycle Management Create, review, manage and sign contracts Legal Project Management Centralize your work and keep projects moving Cross-product capabilities Get scalability, efficiency and connectivity LinkSquares Onboarding Experience A step by step guide to get started today
---
[Solutions](https://linksquares.com/solutions/) [Customer Stories](https://linksquares.com/customers/) Resources
Content
[LinkSquares+ Content curated for in-house leaders](https://linksquares.com/plus/) [The Library](https://linksquares.com/library/)
In the studio
[Demo Library](https://linksquares.com/demo-library/)
Community & Events
[Customer Stories](https://linksquares.com/customers/) [Events & Webinars](https://linksquares.com/events/)
Learning
[Blog](https://blog.linksquares.com/) [In-House Insights](https://linksquares.com/inhouse-insights/) [Knowledge Base](https://help.linksquares.com/)
[Events](https://linksquares.com/events/) [About Us](https://linksquares.com/about-us/) [Careers](https://linksquares.com/careers/) [Press](https://blog.linksquares.com/tag/linksquares-news-press) [Pricing](https://linksquares.com/pricing/)
[Request a demo](https://linksquares.com/demo-request/)
Back
Close Mobile Menu
[Contract Lifecycle Management](https://linksquares.com/products/)
[Finalize Streamline your contract creation process](https://linksquares.com/products/finalize/) [Sign Get your contracts executed faster](https://linksquares.com/products/sign/) [Analyze Your post-signature analytics & repository](https://linksquares.com/products/analyze/) [CLM Suite One platform to rule them all](https://linksquares.com/products/)
[Request a demo](https://linksquares.com/demo-request/)
Back
Close Mobile Menu
[Legal Project Management](https://linksquares.com/products/)
[Prioritize Manage, track, and report on legal work in one place](https://linksquares.com/products/prioritize/)
[Request a demo](https://linksquares.com/demo-request/)
Back
Close Mobile Menu
[Cross-product capabilities](https://linksquares.com/products/)
[LinkAI Predictive and generative AI](https://linksquares.com/products/analyze/features/ai/) [Integrations Connect the tools you love](https://linksquares.com/integrations/) [Reporting Improve your teams efficiency with KPIs](https://linksquares.com/products/analyze/features/dashboard/) [API Integrate with any third-party app](https://linksquares.com/integrations/linksquares-api/)
[Request a demo](https://linksquares.com/demo-request/)
Back
Close Mobile Menu
[Cross-product capabilities](https://linksquares.com/products/)
[Onboarding We're here for you from day one](https://linksquares.com/onboarding-services/) [Services Short on time? We can help!](https://linksquares.com/services/) [Support Get answers to all of your technical questions](https://linksquares.com/contact-us/)
[Request a demo](https://linksquares.com/demo-request/)
[LinkSquares](https://linksquares.com/)
- [Why LinkSquares](https://linksquares.com/why-linksquares/)
- Products
Introducing: Agentic AI for Contract Management
Search, edit, and create contracts like never before.
[Learn more](https://linksquares.com/agentic-ai/)
Contract Lifecycle Management Create, review, manage and sign contracts Legal Project Management Centralize your work and keep projects moving Unified Capabilities Get scalability, efficiency and connectivity LinkSquares Onboarding Experience A step by step guide to get started quickly
[Finalize Streamline your contract creation process](https://linksquares.com/products/finalize/) [Sign Get your contracts executed faster](https://linksquares.com/products/sign/) [Analyze Your post-signature analytics & repository](https://linksquares.com/products/analyze/) [CLM Suite One platform to rule them all](https://linksquares.com/products/)
[Prioritize Manage, track, and report on legal work in one place](https://linksquares.com/products/prioritize/)
[LinkAI Predictive and generative AI](https://linksquares.com/ai/) [Agentic AI Smarter contracting with a multi-agent approach](https://linksquares.com/agentic-ai/) [Integrations Connect the tools you love](https://linksquares.com/integrations/) [Reporting Improve your teams efficiency with KPIs](https://linksquares.com/products/analyze/features/dashboard/) [API Integrate with any third-party app](https://linksquares.com/integrations/linksquares-api/)
[Onboarding We're here for you from day one](https://linksquares.com/onboarding-services/) [Services Short on time? We can help!](https://linksquares.com/services/) [Support Get answers to all of your technical questions](https://linksquares.com/contact-us/)
- Solutions
Use Cases
[Crisis Management](https://linksquares.com/solutions/crisis-management/) [Contract Review](https://linksquares.com/solutions/contract-review/) [Contract Storage](https://linksquares.com/solutions/contract-storage/) [Data Privacy & Compliance](https://linksquares.com/solutions/data-privacy-compliance/)
[Deal Acceleration](https://linksquares.com/solutions/deal-acceleration/) [Mergers & Acquisitions](https://linksquares.com/solutions/fundraising-and-ma/) [Vendor Management](https://linksquares.com/solutions/vendor-management/)
---
DEPARTMENTS
[Legal](https://linksquares.com/solutions/linksquares-for-legal/) [Procurement](https://linksquares.com/solutions/linksquares-for-procurement/) [Sales](https://linksquares.com/solutions/linksquares-for-sales/)
- Resources
Content
[LinkSquares+ Content curated for in-house leaders](https://linksquares.com/plus/) [The Library](https://linksquares.com/library/)
Community & Events
[Customer Stories](https://linksquares.com/customers/) [Events & Webinars](https://linksquares.com/events/)
In the studio
[Demo Library](https://linksquares.com/demo-library/)
Learning
[Blog](https://blog.linksquares.com/) [In-House Insights](https://linksquares.com/inhouse-insights/) [Knowledge Base](https://help.linksquares.com/)
[](https://linksquares.com/events/product-spotlight-webinar-risk-revolution/)
- Company
[About Us](https://linksquares.com/about-us/) [Careers](https://linksquares.com/careers/) [Events](https://linksquares.com/events/) [Partner Program](https://linksquares.com/partners/) [Press](https://blog.linksquares.com/tag/linksquares-news-press)
- [Pricing](https://linksquares.com/pricing/)
- [Login](https://app.linksquares.com/)
- [Request a demo](https://linksquares.com/demo-request/)
[Alyssa Verzino](https://blog.linksquares.com/author/alyssa-verzino) Nov 29, 2022 14 min read
# Cookie Laws Across the US
Data privacy laws are increasingly shaping how websites operate across the globe, and cookie laws in the US are a key part of that landscape. As of today, the United States does not have a single federal cookie law, but a growing patchwork of US data privacy legislation, especially at the state level, governs how companies must handle cookies, consent, and personal data. Consumer awareness of these issues is on the rise, and studies show that most users are unlikely to do business with a brand they do not trust to protect their data.
For our updated [2024 cookie laws](https://blog.linksquares.com/navigating-cookie-laws-in-2024-how-legal-teams-can-stay-ahead) you can learn more here.
[State privacy laws](https://kashmerinteractive.com/the-rise-of-cookie-banners-in-the-u-s-state-level-consent-rules-compliance-strategies/?utm_source=chatgpt.com) are expanding beyond the original group enacted by the end of 2023. Several new comprehensive privacy statutes have taken effect or will take effect through 2025 and 2026, expanding opt‑out and consent obligations tied to cookies and personal data tracking. These include laws in Texas, Florida, Oregon, Montana, Iowa, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, and more, with additional laws beginning January 1, 2026 in Indiana, Kentucky, and Rhode Island. These broader US data privacy legislation frameworks typically require consent‑management features like universal opt‑out signals, transparency about cookie tracking, and honoring consumer choice signals (e.g., Global Privacy Control) even if they do not explicitly target cookies alone.
## What are Cookies?
Cookies are tiny data files that track user behavior in the browser and are used to build customized buyer profiles. They can be used for functions as benign as remembering logins and items in a shopping cart and also for personalized advertising.
On the one hand, cookies help companies provide that personalized experience consumers crave. But on the other hand, there is such a low level of trust around cookies that many users opt out of them when given the option.
While the US does not have a federal cookie law, five states have adopted their own: California, Virginia, Colorado, Utah, and Connecticut. While they are all pretty similar, there are a few key differences among them. For example, each cookie law has its own way of defining a consumer, personal information, a sale, and the rights of a consumer.
Here’s a quick roundup of cookie laws in the US and what you need to know.
## California Privacy Rights Act (CPRA)
Since January 1, 2023, the California Privacy Rights Act ([CPRA](https://privacy.gtlaw.com)) has been in effect, expanding and replacing the California Consumer Privacy Act (CCPA) of 2020. It applies to businesses that transact the personal data of 100,000 California residents, have a gross annual revenue exceeding $25M, or earn more than half their annual revenue through selling the personal data of California residents.
The CCPA defines personal data as any information that “identifies, relates to, describes, and is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The CPRA takes it one step further to include sensitive personal information, including but not limited to social security number, race, gender, location, and genetic data.
Still, unless the cookies collect the personal data of minors, the CPRA does not require explicit consent to use cookies. Instead, it allows businesses that meet the criteria to collect cookie data as long as users are given the opportunity to opt-out. That is, businesses must disclose their use of cookies and their purposes and allow consumers the chance to deny participation. This means you can’t load non-essential cookies until the user says you can. Even more, you need to get explicit consent to process, sell, or share the personal information or data you collect.
CPRA is a business-specific offshoot of the California Online Privacy Protection Act (CalOPPA), a regulation that applies to online services that collect personal identifying information about California residents, regardless of the location of the business.
## Virginia Consumer Data Protection Act (VCDPA)
Like the CPRA, the Virginia Consumer Data Protection Act ([VCDPA](https://law.lis.virginia.gov/vacode/title59.1/chapter53/)) has been in effect since January 2023. It applies to organizations that do business in Virginia or with Virginia residents, control or process the personal data of Virginia residents or earn a certain threshold of their income from the sale of their data.
The VCDPA (like UCPA and CPA) excludes publicly available and deidentified data from its definition of personal data.
Like the CPRA, the VCDPA must allow users to opt-out of their data being used for “targeted advertising” – don’t pre-check the box on the cookie banner. Plus, users need to opt-in for you to process their sensitive data, and you can only process the data as disclosed in your privacy policy.
The VCDPA gives consumers the right to:
- Access, correct, and delete their personal data
- Get a copy of their personal data
- Submit a complaint about a company’s data practices
- Opt-out of sale of personal data
- Opt out of consumer profiling based on data
- Not be discriminated against for enforcing their rights.
Noncompliant businesses can face up to $7,500 per infringement.
## Colorado’s Privacy Act (CPA)
Colorado’s Privacy Act ([CPA](https://legiscan.com/CO/text/SB190/id/2419357)), in effect since July 1, 2023, applies to any data controller that operates in or sells to residents of Colorado, controls or processes the personal data of 100,000 or more consumers per year, or gains some financial benefit from selling personal data while controlling/processing the data of at least 25,000 consumers.
According to the CPA, the consumer — defined as “a Colorado resident acting only in an individual or household context” — has the following rights:
- To know if their data is being processed
- To access their data
- To correct inaccuracies within their data
- To opt out of processing data for targeted advertising, consumer profiling, and having their data sold
- To appeal a business’ denial of their request to remove or take some other action with their data.
While cookies aren’t explicitly mentioned in the CPA, cookie data is implied by personal data used for advertising and consumer profiling.
Using the opt-out consent model, data controllers are required to give the consumer notice about the options available to them, what data of theirs will be used, and what it will be used for. In that vein, data controllers have a duty under the CPA to minimize the data they collect, limiting it to only that which is necessary and relevant to their business operations.
[](https://cta-redirect.hubspot.com/cta/redirect/6934676/6c829038-f0ba-496b-9e24-cdde3df33a02)
## Utah Consumer Privacy Act (UCPA)
Utah’s Consumer Privacy Act ([UCPA](https://legiscan.com/UT/text/SB0227/id/2546519)), in effect since December 2023, is more business-friendly than the other regulations. It applies to any data controller or processor that does business in Utah or with Utah residents, has over $25M in annual revenue, and processes a certain threshold of data while meeting certain revenue requirements.
Within the UCPA, the consumer — defined as “an individual who is a resident of the state acting in an individual or household context” — has the right to access, get a copy of, and request deletion of their data. Like in the CPA, consumers have the right to opt out of having their data processed for targeted advertising or sale.
The UCPA does not apply to nonprofits, colleges and universities, covered entities, and certain business associates that do not meet the revenue threshold. The companies that the UCPA does apply to must have a privacy notice that discloses the data your business collects, what you do with it, how consumers can exercise their rights, and what third parties data controllers share the information with.
## Connecticut Data Privacy Act (CDPA)
One of the more consumer-friendly privacy laws, the Connecticut Data Privacy Act ([CDPA](https://www.gibsondunn.com/us-privacy-law-update-connecticut-enacts-comprehensive-privacy-law-as-other-states-laws-continue-to-develop/)) has been in effect since July 1, 2023. Businesses operating in Connecticut or target Connecticut residents that control or process a certain amount of their data are now required to be compliant.
Like the others before it, the CDPA also gives consumers the right to know whether a company is using their data, what it is being used for, and the ability to get a copy of, correct, or request deletion of their personal data. Consumers must be able to opt-out of targeted advertising, consumer profiling, and sale of their data. And to process sensitive personal data, consumers need to actively and explicitly opt-in.
The CDPA also requires businesses to limit their collection of personal data. So rather than collecting data for the sake of it, organizations are being asked to be more judicious about what data they actually need to carry out their everyday functions.
Noncompliant businesses can face up to $5k in fines per willful violation.
## Stay Ahead of Cookie Laws in the US
While cookie laws in the US reflect many principles of the General Data Privacy Regulation (GDPR), each state law has its own nuances that businesses, data controllers, and processors must follow to remain compliant. Since these laws have been in effect since 2023, it’s essential for organizations to review their cookie consent USA practices and ensure their data collection aligns with current US data privacy legislation. At LinkSquares, we provide resources and insights to help businesses stay up to date with evolving privacy requirements. [Subscribe to our blog](https://go.linksquares.com/blog-subscription) for more guidance and actionable tips to keep your organization compliant and build trust with your users.
#### [Alyssa Verzino](https://blog.linksquares.com/author/alyssa-verzino)
Alyssa Verzino is a Senior Content Marketing Manager at LinkSquares.
## Subscribe to the LinkSquares Blog
Stay up to date on best practices for GCs and legal teams, current events, legal tech, and more.
## Related Articles
### [Christina Sullivan Mar 20, 2023 6 min read CPRA: How Legal & Marketing Can Collaborate to Ensure Compliance Despite a few roadblocks at the end of 2022, the California Privacy Rights Act (CPRA) will go into effect early 2023. The clock ... Start Reading](https://blog.linksquares.com/cpra-how-legal-marketing-can-collaborate-to-ensure-compliance)
### [Christina Sullivan Jul 05, 2022 6 min read Proactive Data Privacy: How Legal Can Prepare for 2023 and Beyond The Problem Picture this: the smell of fresh coffee wafts throughout your company’s headquarters. The conference room is aglow ... Start Reading](https://blog.linksquares.com/how-legal-can-prepare-for-data-privacy-2023)
### [Alyssa Verzino Feb 22, 2023 5 min read The GDPR Impact on Corporate Legal Teams The General Data Protection Regulation (GDPR) has been in effect since 2018 and continues to impact corporate legal teams in ... Start Reading](https://blog.linksquares.com/the-gdpr-impact-on-corporate-legal-teams)
- [Products](https://linksquares.com/products)
- [LinkSquares Cloud](https://linksquares.com/products/linksquares-cloud/)
- [Prioritize](https://linksquares.com/products/prioritize/)
- [Finalize](https://linksquares.com/products/finalize)
- [Sign](https://linksquares.com/products/sign)
- [Analyze](https://linksquares.com/products/analyze)
- [Full Suite](https://linksquares.com/products)
- [Integrations](https://linksquares.com/integrations)
- [Reporting](https://linksquares.com/products/analyze/features/dashboard/)
- [API](https://linksquares.com/integrations/linksquares-api/)
- [LinkAI](https://linksquares.com/ai/)
- [Agentic AI](https://linksquares.com/agentic-ai/)
- [Services](https://linksquares.com/services/)
- [Solutions](https://linksquares.com/solutions)
- [Crisis Management](https://linksquares.com/solutions/crisis-management/)
- [Contract Review](https://linksquares.com/solutions/contract-review/)
- [Contract Storage](https://linksquares.com/solutions/contract-storage/)
- [Data Privacy & Compliance](https://linksquares.com/solutions/data-privacy-compliance/)
- [Deal Acceleration](https://linksquares.com/solutions/deal-acceleration/)
- [Mergers & Acquisitions](https://linksquares.com/solutions/fundraising-and-ma/)
- [Vendor Management](https://linksquares.com/solutions/vendor-management/)
- Departments
- [Legal](https://linksquares.com/solutions/linksquares-for-legal/)
- [Procurement](https://linksquares.com/solutions/linksquares-for-procurement/)
- [Sales](https://linksquares.com/solutions/linksquares-for-sales/)
- [Resources](https://linksquares.com/library)
- [LinkSquares+](https://linksquares.com/plus)
- [Blog](https://blog.linksquares.com/)
- [Cockpit Counsel](https://linksquares.com/cockpit-counsel-series)
- [Customer Stories](https://linksquares.com/customers)
- [Demo Library](https://linksquares.com/demo-library)
- [Events & Webinars](https://linksquares.com/events)
- [In-House Insights](https://linksquares.com/inhouse-insights/)
- [Knowledge Base](https://help.linksquares.com/)
- [The Library](https://linksquares.com/resources)
- Company
- [About Us](https://linksquares.com/about-us)
- [Careers](https://linksquares.com/careers)
- [Contact Us](https://linksquares.com/contact-us/)
- [Onboarding](https://linksquares.com/onboarding-services/)
- [Partner Program](https://linksquares.com/partners)
- [Pricing](https://linksquares.com/pricing/)
- [Press](https://blog.linksquares.com/tag/linksquares-news-events)
- [Recognition](https://linksquares.com/recognition/)
- [Support](mailto:support@linksquares.com)
- [Why LinkSquares](https://linksquares.com/why-linksquares/)
#### LINKSQUARES, INC.
60 State St.
Suite 1200
Boston, MA 02109
[617-681-8552](tel:617-681-8552)
[salesinfo@linksquares.com](mailto:salesinfo@linksquares.com)
© 2026 LinkSquares, Inc.
- [SaaS Terms of Service](https://linksquares.com/saas-terms-of-service/)
- [Privacy](https://linksquares.com/privacy-policy/)
- [Security](https://linksquares.com/security/)
- [Status](https://linksquares.statuspage.io/)
- [Your Privacy Choices](https://go.linksquares.com/linksquares-do-not-sell-or-share-personal-data)
- 
- 
```json
{
"@context" : "http://schema.org",
"@type" : "Organization",
"address" : {
"@type" : "PostalAddress",
"addressCountry" : "United States",
"addressLocality" : "Boston",
"addressRegion" : "MA",
"postalCode" : "02109",
"streetAddress" : "60 State Street"
},
"knowsLanguage" : "en",
"logo" : {
"@type" : "ImageObject",
"url" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Navigation/logo_643dd1b1.svg"
},
"name" : "LinkSquares",
"url" : "https://blog.linksquares.com/cookie-laws-across-the-us"
}
```
```json
{
"@context" : "http://schema.org",
"@type" : "BlogPosting",
"abstract" : "Cookie laws in the US are similar to one another and reflect the basic principles of the GDPR, but they each have particular nuances. Stay up to date here.",
"author" : {
"@type" : "Person",
"name" : "Alyssa Verzino"
},
"dateModified" : "2026-02-09T20:28:16Z",
"datePublished" : "2022-11-29T13:58:37Z",
"headline" : "Cookie Laws Across the US",
"image" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Copy%20of%20Legal%20Best%20Practices_Thumbnail-Nov-29-2022-01-46-54-9746-PM.png",
"inLanguage" : "en",
"keywords" : "[Security & Data Privacy]",
"mainEntityOfPage" : {
"@type" : "WebPage"
},
"name" : "Cookie Laws Across the US",
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://6934676.fs1.hubspotusercontent-na1.net/hubfs/6934676/Navigation/logo_643dd1b1.svg"
},
"name" : "LinkSquares"
},
"text" : "Data privacy laws are increasingly shaping how websites operate across the globe, and cookie laws in the US are a key part of that landscape. As of today, the United States does not have a single federal cookie law, but a growing patchwork of US data privacy legislation, especially at the state level, governs how companies must handle cookies, consent, and personal data. Consumer awareness of these issues is on the rise, and studies show that most users are unlikely to do business with a brand they do not trust to protect their data. For our updated 2024 cookie laws you can learn more here. State privacy laws are expanding beyond the original group enacted by the end of 2023. Several new comprehensive privacy statutes have taken effect or will take effect through 2025 and 2026, expanding opt‑out and consent obligations tied to cookies and personal data tracking. These include laws in Texas, Florida, Oregon, Montana, Iowa, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, and more, with additional laws beginning January 1, 2026 in Indiana, Kentucky, and Rhode Island. These broader US data privacy legislation frameworks typically require consent‑management features like universal opt‑out signals, transparency about cookie tracking, and honoring consumer choice signals (e.g., Global Privacy Control) even if they do not explicitly target cookies alone. What are Cookies? Cookies are tiny data files that track user behavior in the browser and are used to build customized buyer profiles. They can be used for functions as benign as remembering logins and items in a shopping cart and also for personalized advertising. On the one hand, cookies help companies provide that personalized experience consumers crave. But on the other hand, there is such a low level of trust around cookies that many users opt out of them when given the option. While the US does not have a federal cookie law, five states have adopted their own: California, Virginia, Colorado, Utah, and Connecticut. While they are all pretty similar, there are a few key differences among them. For example, each cookie law has its own way of defining a consumer, personal information, a sale, and the rights of a consumer. Here’s a quick roundup of cookie laws in the US and what you need to know. California Privacy Rights Act (CPRA) Since January 1, 2023, the California Privacy Rights Act (CPRA) has been in effect, expanding and replacing the California Consumer Privacy Act (CCPA) of 2020. It applies to businesses that transact the personal data of 100,000 California residents, have a gross annual revenue exceeding $25M, or earn more than half their annual revenue through selling the personal data of California residents. The CCPA defines personal data as any information that “identifies, relates to, describes, and is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The CPRA takes it one step further to include sensitive personal information, including but not limited to social security number, race, gender, location, and genetic data. Still, unless the cookies collect the personal data of minors, the CPRA does not require explicit consent to use cookies. Instead, it allows businesses that meet the criteria to collect cookie data as long as users are given the opportunity to opt-out. That is, businesses must disclose their use of cookies and their purposes and allow consumers the chance to deny participation. This means you can’t load non-essential cookies until the user says you can. Even more, you need to get explicit consent to process, sell, or share the personal information or data you collect. CPRA is a business-specific offshoot of the California Online Privacy Protection Act (CalOPPA), a regulation that applies to online services that collect personal identifying information about California residents, regardless of the location of the business. Virginia Consumer Data Protection Act (VCDPA) Like the CPRA, the Virginia Consumer Data Protection Act (VCDPA) has been in effect since January 2023. It applies to organizations that do business in Virginia or with Virginia residents, control or process the personal data of Virginia residents or earn a certain threshold of their income from the sale of their data. The VCDPA (like UCPA and CPA) excludes publicly available and deidentified data from its definition of personal data. Like the CPRA, the VCDPA must allow users to opt-out of their data being used for “targeted advertising” – don’t pre-check the box on the cookie banner. Plus, users need to opt-in for you to process their sensitive data, and you can only process the data as disclosed in your privacy policy. The VCDPA gives consumers the right to: Access, correct, and delete their personal data Get a copy of their personal data Submit a complaint about a company’s data practices Opt-out of sale of personal data Opt out of consumer profiling based on data Not be discriminated against for enforcing their rights. Noncompliant businesses can face up to $7,500 per infringement. Colorado’s Privacy Act (CPA) Colorado’s Privacy Act (CPA), in effect since July 1, 2023, applies to any data controller that operates in or sells to residents of Colorado, controls or processes the personal data of 100,000 or more consumers per year, or gains some financial benefit from selling personal data while controlling/processing the data of at least 25,000 consumers. According to the CPA, the consumer — defined as “a Colorado resident acting only in an individual or household context” — has the following rights: To know if their data is being processed To access their data To correct inaccuracies within their data To opt out of processing data for targeted advertising, consumer profiling, and having their data sold To appeal a business’ denial of their request to remove or take some other action with their data. While cookies aren’t explicitly mentioned in the CPA, cookie data is implied by personal data used for advertising and consumer profiling. Using the opt-out consent model, data controllers are required to give the consumer notice about the options available to them, what data of theirs will be used, and what it will be used for. In that vein, data controllers have a duty under the CPA to minimize the data they collect, limiting it to only that which is necessary and relevant to their business operations. Utah Consumer Privacy Act (UCPA) Utah’s Consumer Privacy Act (UCPA), in effect since December 2023, is more business-friendly than the other regulations. It applies to any data controller or processor that does business in Utah or with Utah residents, has over $25M in annual revenue, and processes a certain threshold of data while meeting certain revenue requirements. Within the UCPA, the consumer — defined as “an individual who is a resident of the state acting in an individual or household context” — has the right to access, get a copy of, and request deletion of their data. Like in the CPA, consumers have the right to opt out of having their data processed for targeted advertising or sale. The UCPA does not apply to nonprofits, colleges and universities, covered entities, and certain business associates that do not meet the revenue threshold. The companies that the UCPA does apply to must have a privacy notice that discloses the data your business collects, what you do with it, how consumers can exercise their rights, and what third parties data controllers share the information with. Connecticut Data Privacy Act (CDPA) One of the more consumer-friendly privacy laws, the Connecticut Data Privacy Act (CDPA) has been in effect since July 1, 2023. Businesses operating in Connecticut or target Connecticut residents that control or process a certain amount of their data are now required to be compliant. Like the others before it, the CDPA also gives consumers the right to know whether a company is using their data, what it is being used for, and the ability to get a copy of, correct, or request deletion of their personal data. Consumers must be able to opt-out of targeted advertising, consumer profiling, and sale of their data. And to process sensitive personal data, consumers need to actively and explicitly opt-in. The CDPA also requires businesses to limit their collection of personal data. So rather than collecting data for the sake of it, organizations are being asked to be more judicious about what data they actually need to carry out their everyday functions. Noncompliant businesses can face up to $5k in fines per willful violation. Stay Ahead of Cookie Laws in the US While cookie laws in the US reflect many principles of the General Data Privacy Regulation (GDPR), each state law has its own nuances that businesses, data controllers, and processors must follow to remain compliant. Since these laws have been in effect since 2023, it’s essential for organizations to review their cookie consent USA practices and ensure their data collection aligns with current US data privacy legislation. At LinkSquares, we provide resources and insights to help businesses stay up to date with evolving privacy requirements. Subscribe to our blog for more guidance and actionable tips to keep your organization compliant and build trust with your users.",
"url" : "https://blog.linksquares.com/cookie-laws-across-the-us",
"wordCount" : "1931"
}
```