Which US state privacy laws require a cookie opt-out?

California's CCPA was first, and more than a dozen states now have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others. Most follow the opt-out model: sites must let residents refuse targeted advertising, and several require honoring universal opt-out signals.

The common pattern

State laws differ in detail but converge on a set of consumer rights: know what data is collected, delete it, correct it, and opt out of targeted advertising, sale, and profiling. For websites, targeted advertising is the provision that touches cookies and ad pixels most directly.

Universal opt-out signals

A growing number of states, including California, Colorado, and Connecticut, require businesses to honor universal opt-out mechanisms such as Global Privacy Control. A banner that detects and respects these signals covers several state requirements at once.

What this means practically

A US-facing site needs a consent setup that offers a visible opt-out for targeted advertising, honors opt-out signals automatically, and records the choice. Layering this with an opt-in banner for EU and UK visitors covers the full US state patchwork as it stands.