GDPR, CCPA, and the State Patchwork: What a US Business Website Actually Has to Do

Most articles about privacy law march through each statute in turn and leave you no better able to decide what to do on Monday. This one is organized the other way round: by the question a website owner actually has, which is does this apply to me, and if so what changes on my site?

Two assumptions cause most of the trouble. The first is that GDPR is a European problem. The second is that US state privacy law is a California problem. Both were shaky five years ago and neither survives contact with 2026.

The European rules reach further than people expect

GDPR applies based on whose data you process, not where your company is incorporated. If you offer goods or services to people in the EU, or monitor their behavior — and running analytics or retargeting on visitors from the EU is monitoring their behavior — you are in scope regardless of having no European office, entity or bank account.

The cookie rules specifically come from a companion law, the ePrivacy Directive, implemented locally in each country and in the UK through PECR. The practical effect is what matters:

• Consent must come first. Non-essential cookies and similar technologies may not be placed until the visitor agrees. Not on page load, not while the banner is displayed — before means before.
• Consent must be affirmative. Pre-ticked boxes do not count. Continuing to scroll does not count. Silence does not count.
• Declining must be as easy as accepting. Regulators have been explicit and repeatedly unimpressed by the one-click-accept, three-click-decline layout.
• Consent must be withdrawable as easily as it was given, and you should be able to evidence it later.

A genuinely small US business with negligible European traffic carries correspondingly small practical risk here. But “we don’t do business in Europe” is a statement about intent, and your analytics are a statement about fact. It is worth checking which one is true before relying on it.

The US picture: twenty states and an old wiretapping law

As of 2026, twenty states have comprehensive consumer privacy laws in effect, with Indiana, Kentucky and Rhode Island joining at the start of the year and several more enacted and phasing in after that. There is still no federal equivalent; proposals have stalled in Congress repeatedly. Multi-state compliance is simply the operating condition for anyone selling nationally.

The good news is that these laws are more alike than different. Most follow a similar template, and three requirements drive nearly all of the website-level work:

1. Opt-out of sale and targeted advertising

The US model is generally opt-out rather than opt-in: you may run tracking by default, but you must offer a clear way to stop. The catch is the definition of “sale,” which in several states is broad enough to cover sharing data with an advertising platform in exchange for value — no money need change hands. Running the Meta pixel or Google’s advertising tags can land you inside that definition without any transaction that feels like a sale.

2. Honoring the Global Privacy Control

A growing number of states require that you recognize a browser-level opt-out signal, most commonly the Global Privacy Control. This is a technical obligation, not a policy one. A visitor arriving with GPC enabled must be treated as having opted out, automatically, with no click on your banner at all. Many consent platforms support this and ship with it switched off.

3. Opt-in for sensitive data

Most state laws flip to opt-in for sensitive categories — health, precise geolocation, biometrics, and in some states data about minors. Several states have tightened the rules around children’s data recently. If your site touches any of this, the general opt-out posture is not sufficient.

The thing that is actually generating lawsuits

Here is the wrinkle that catches businesses off guard: the most active source of legal exposure for ordinary websites right now is not the new privacy statutes at all. It is old wiretapping law.

California’s Invasion of Privacy Act was written in 1967 for telephone surveillance. Plaintiffs’ firms have spent the last several years arguing that third-party tracking scripts — pixels, session replay, chat widgets — intercept a visitor’s communications without consent, and courts have entertained the theory often enough for it to become a standing campaign. The statute carries a private right of action with statutory damages, which is what makes it attractive: the claim does not require proving financial harm, and it can be pleaded at scale against any site running a common advertising stack.

The outcomes have been genuinely mixed. Courts have split, some cases have settled substantially and others have been dismissed outright on near-identical facts. Anyone who tells you the law here is settled is overselling. But two things are not in dispute: a large volume of demand letters is going out, and the fact pattern that triggers them is mechanically simple — trackers firing before the visitor consented. Other states have their own wiretap statutes and plaintiffs have begun testing the same theory under them.

What this actually means for your site

Strip away the jurisdictional detail and the technical work converges on a short list:

1. Know what you load. You cannot categorize scripts you have not inventoried, and most sites are running things nobody remembers adding.
2. Block before consent for EU and UK visitors, properly, at the script level.
3. Offer a working opt-out for US visitors, and honor GPC automatically.
4. Make decline as easy as accept. Cheap to fix, highly visible if you don’t.
5. Log consent so you can evidence it.
6. Verify it works — and re-verify, because sites change.

Done correctly, one well-configured consent setup handles the regional differences for you: EU and UK visitors get what those laws require, US opt-out signals are honored, and everyone else’s experience is unchanged. The complexity lives in the configuration, not in your day-to-day.

We’re not attorneys and this isn’t legal advice. We handle the technical side: making sure what’s on your site does what you think it does.

---

Find out what your site is actually loading

We’ll run the audit and show you what fires before anyone clicks accept.