Do I Need a Cookie Banner? A Plain-English U.S. Answer for 2026

Every few weeks a plugin vendor or a “compliance” email tells you your website will be fined without a cookie banner. Then you look at the sites you visit and half of them have one, half don’t, and nobody can tell you which half is right.

Here’s the plain answer to “do I need a cookie banner” for a U.S. small business: usually not, because U.S. privacy laws generally don’t require one as such. What the law does require, in some cases, is a privacy policy, a way to opt out of having your data sold or shared, and respect for a browser signal called Global Privacy Control. Visitors from Europe and Google’s advertising tags can change the picture.

This article explains when a banner is required or effectively required, what a fair one looks like, and what we did on our own site. It’s general information, not legal advice; if you’re near the thresholds below or handle sensitive data, check with a privacy lawyer.

Do I need a cookie banner in the U.S.?

Short answer: In most cases, no. For most data, U.S. privacy laws work on notice and opt-out, not opt-in consent before cookies. The Congressional Research Service puts it directly: the CCPA “does not mandate cookie disclosure banners or require user consent prior to the use of cookies.”

That line comes from a CRS report on online data collection. Instead of consent up front, California’s law requires covered businesses to disclose what they collect in a privacy policy and, if they sell or share data, to let people opt out.

California’s regulations go a step further and say a banner isn’t enough for that opt-out. Section 7026 of the CCPA regulations states that “a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of sale/sharing,” because cookies concern collection, not selling or sharing. Plenty of sites have a banner and still miss the requirement that actually applies to them.

When does the CCPA apply to a small business?

Short answer: When it does business in California and meets any one of three tests: gross annual revenue above $26,625,000, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half its revenue from selling or sharing personal information.

The revenue figure is the inflation-adjusted threshold that took effect on January 1, 2025, according to the California Privacy Protection Agency. The same adjustment set fines at up to $2,663 per violation and $7,988 per intentional violation.

The second test is the one that catches small sites by surprise. Under the CCPA, “sharing” means sharing personal information for cross-context behavioral advertising, which is what ad pixels are built to do. A $3 million landscaping company with no ad pixels is very unlikely to be covered. An online store with a Meta pixel and heavy California traffic should ask a lawyer whether it crosses the 100,000 line, even with modest revenue.

California isn’t alone. Colorado’s privacy law has required covered businesses to honor Global Privacy Control since July 1, 2024, and other states have followed. By one compliance vendor’s June 2026 count, 12 states now require covered businesses to honor GPC, including California, Colorado, Connecticut, Texas, Oregon and New Jersey. Each state sets its own thresholds, so a business too small for one law may be covered by another.

What is Global Privacy Control, and do you have to honor it?

Short answer: Global Privacy Control (GPC) is a setting in some browsers and extensions that tells every site “don’t sell or share my data.” If you’re covered by the CCPA and you sell or share personal information, California requires you to treat it as a valid opt-out request, and since January 1, 2026 you must show visitors that you processed it.

Technically, GPC arrives as an HTTP header (Sec-GPC) and is readable in JavaScript as navigator.globalPrivacyControl, which MDN says returns true when the user “explicitly does not provide consent to sell or share their data.” According to globalprivacycontrol.org, Brave and DuckDuckGo support it natively and have it on by default, and Firefox offers it in its settings.

California’s rules on this are in section 7025 of the regulations. A business that sells or shares personal information “shall process any opt-out preference signal” that meets the requirements. The version in force since January 1, 2026 also says a business “must display whether it has processed” the signal, and gives “Opt-Out Request Honored” as an example of what to show.

Enforcement is real. In September 2025 California, Colorado and Connecticut announced a joint sweep of businesses that weren’t processing GPC opt-outs. And the California Opt Me Out Act (AB 566), signed in October 2025, requires browsers to offer an opt-out signal from January 2027, so expect many more visitors to send one.

What does a good cookie banner look like?

Short answer: Equal choices. “Accept all” and “Reject all” should be the same size and the same number of clicks, with a way to adjust categories and a link to change your mind later. Avoid pre-ticked boxes, a tiny “reject” link and a reject option hidden behind “Settings”; California’s Honda case was about the last one.

California’s regulations call this “symmetry in choice”: the path to the more privacy-protective option “shall not be longer or more difficult or time-consuming” than the path to the less protective one. The Honda case shows what that means in practice. Its order describes how visitors could “Accept All” cookies in one click, while opting out took at least two, and it required Honda to add a “Reject All” button next to “Allow All.” Honda paid $632,500 to settle that and other alleged violations.

A tool doesn’t protect you if it’s set up wrong. The agency fined clothing retailer Todd Snyder $345,178 in 2025, after alleging that a misconfigured privacy portal left opt-out requests unprocessed for 40 days. The agency’s announcement put it bluntly: “Using a consent management platform doesn’t get you off the hook for compliance.”

If you do use a banner, check it against this list:

• “Accept all” and “Reject all” on the first screen, equally prominent.
• A settings view with plain-language categories.
• Where consent is required, such as for EU visitors, nothing optional switched on or loaded before the visitor chooses.
• A link on every page, usually in the footer, to reopen the choices.
• GPC respected automatically, without making the visitor click anything.

Watch out: Where consent is required, a banner does nothing if your ad and analytics tags load before anyone clicks. Open your site in a private window, open your browser’s developer tools and look at the cookies and local storage before you touch the banner. If tracking tags are already there, the banner is decoration.

Do EU visitors change the answer?

Short answer: They can. If you market to people in the EU, EU rules expect consent before you store or read non-essential cookies or similar data on their devices. Separately, Google requires consent from users in the EEA, the UK and Switzerland before its ad and analytics products use cookies where the law requires it.

The EU rule isn’t limited to cookies. The European Data Protection Board’s guidelines on the ePrivacy rule say it covers information stored in a browser, including local storage, once that information is accessed. Whether EU rules reach a U.S. business with only the odd European visitor is a legal question; if Europe is part of your market, plan for opt-in consent.

Google’s EU user consent policy applies whenever you use Google products with users in those countries. You must get consent for cookies or other local storage where legally required, and for using personal data to personalize ads, keep records of that consent and tell users how to withdraw it. Google’s tool for passing those choices to its tags is consent mode, which uses four settings: ad_storage, analytics_storage, ad_user_data and ad_personalization.

Consent mode comes in two forms, per Google Analytics Help. In basic mode, Google tags stay blocked until the visitor agrees. In advanced mode, tags load first and send cookieless pings when consent is denied, which Google uses to model the missing data.

What if you run Google Analytics or a Meta pixel?

Short answer: Google Analytics on a U.S.-focused site usually doesn’t require a banner, but it belongs in your privacy policy. An ad pixel such as Meta’s is different: if you’re covered by the CCPA, sending visitor data to an ad platform for targeting is generally treated as “sharing,” which triggers the opt-out link and GPC duties.

Analytics on its own measures your site. A pixel builds audiences and tracks people across sites for advertising, which is exactly the cross-context behavioral advertising California’s opt-out right covers. If you run ads on Meta, Google or TikTok and want the conversion data, assume the pixel is the part of your site that privacy rules care most about.

There’s also a lawsuit angle in California. The state’s Invasion of Privacy Act (CIPA) has been used in private suits over website tracking. SB 690, signed September 30, 2026 and effective January 1, 2027, ends private “pen register” claims based on website and app technologies, leaving those to the Attorney General. Private claims under CIPA’s wiretapping and recording sections (631 and 632) aren’t affected, so tracking tools still carry some risk.

Our take: If a tag doesn’t earn its keep, remove it. Every pixel, heat-map tool and chat widget you take off the site is one less thing to disclose, one less opt-out to manage and usually a faster page.

What does your privacy policy need to say?

Short answer: If your site collects personal information from Californians, which nearly every site with a contact form does, CalOPPA requires a posted privacy policy. It has to list what you collect and who you share it with, give an effective date, explain how you respond to “Do Not Track” signals if you track people across sites over time, and say whether third parties can track visitors across sites.

That’s California’s Online Privacy Protection Act, Business and Professions Code section 22575. It has no revenue or traffic threshold. It applies to any operator of a commercial website that collects personally identifiable information from California residents, and a business is in violation if it fails to post a compliant policy within 30 days of being notified.

Two lines trip people up. The “Do Not Track” disclosure can be a short statement of how your site responds, or a link to a page describing a program you follow. The third-party tracking disclosure means naming whether tools like analytics or ad pixels can collect information about visitors’ activity across other sites.

What we did on our own site

No U.S. law required a banner for our site, but we added one anyway, because privacy choices are a trust signal and the rules keep tightening. Here’s the setup, as a worked example rather than a template:

1. The notice. First-time visitors see a small notice that doesn’t block the page, with “Accept all” and “Reject all” as equal buttons plus “Settings.”
2. The settings. A dialog shows “Strictly necessary” (always on) and two switches. “Analytics and lead source” covers a record of the page someone first landed on and the site or ad that sent them, kept for 90 days and sent only with a form they submit; Google Analytics, if we ever switch it on, falls under this choice too. “Content from X” covers embedded X posts on one old blog post.
3. The defaults. U.S. visitors start with analytics on and X off. Visitors whose device time zone is in Europe start with both off until they accept. A browser that sends GPC starts with both off, and the dialog shows “Opt-Out Request Honored.”
4. Changing your mind. A “Cookie settings” link in every page footer reopens the dialog. The choice lasts six months, then the site asks again.
5. Embeds. The X posts appear as plain quotes until the visitor allows them or presses “Show posts from X.”

Under the hood, we set no cookies of our own; those records live in the browser’s local storage. We publish a /.well-known/gpc.json file, our Do Not Sell page shows a live line saying whether your browser is sending GPC, and our Cookie and Privacy Policies were updated, including the CalOPPA Do Not Track statement. We didn’t buy a consent platform: it’s a small script written for the site, so it doesn’t slow pages down, and we don’t run visitor tracking.

What to do this week

1. List every tag, pixel, embed and widget on your site, and remove the ones you don’t use.
2. Check whether any CCPA threshold or other state privacy law could apply to you, and ask a privacy lawyer if you’re close.
3. Update your privacy policy with what you collect, who receives it, your Do Not Track response and any third-party tracking.
4. If you run ad pixels, add a clear opt-out link and make sure your site honors GPC automatically.
5. If you use a banner, give “Reject all” the same weight as “Accept all,” and test that nothing loads before the choice.

If you’d like help auditing your tags or building a lightweight consent setup like ours, talk to our web development team; if you’re changing hosts at the same time, see our web hosting options. For the speed side, see how we got our site to 100 in Lighthouse, and for accessibility, our WCAG 2.2 checklist.