The US state privacy patchwork, mapped for site owners

Nineteen laws, one shared blueprint

As of 2026, nineteen or more comprehensive state privacy laws are in force, with Indiana, Kentucky and Rhode Island among the recent additions. That number reads like chaos. It mostly isn't. Outside California, nearly all of them are built on the same template Virginia set in 2021, and once you see the shape, the list stops being nineteen separate problems.

The template works like this. Processing is generally permitted with notice, so no banner blocks the door. Consumers get a right to opt out of targeted advertising, sale, and certain profiling. Sensitive data — precise geolocation, health, biometrics, race, religion, sexual orientation, and in several states citizenship status and children's data — flips to opt-in, requiring consent before processing. Rights to access, correct, delete, and appeal come standard.

California is the outlier everyone knows about. CCPA as amended by CPRA is an opt-out regime, not a consent regime: where it reaches your business, you owe a notice at collection, a working “Do Not Sell or Share My Personal Information” mechanism, and mandatory honoring of Global Privacy Control signals. Anyone calling that a cookie consent law has the arrow pointed backwards, and builds the wrong interface as a result.

The universal opt-out signal is the real line

Twelve states require honoring universal opt-out signals — in practice GPC, a header and a JavaScript property the browser sends with the request, before your page renders. It is not a popup and there is nothing to click. Either your site reads it and suppresses sale and sharing, or it doesn't, and the failure is visible to anyone with developer tools open.

That visibility is why the signal shows up in enforcement so often. California regulators have pursued it repeatedly, and the pattern is mechanical rather than philosophical: a control that existed but did not work, or worked more slowly and awkwardly than the path toward saying yes. None of this is legal advice, but the through-line is easy enough to read.

Todd Snyder's $345,178 penalty in 2025 rounds it out: a misconfigured banner that closed before it could take the request. Nobody was arguing about interpretation. The button didn't do the thing. Test your opt-out path the way you would test checkout — with the signal set, with cookies cleared, on a real page, watching the network tab.

• Sephora, $1.2 million in 2022 — GPC signals ignored
• Honda, $632,500 in 2025 — opting out harder than opting in
• Healthline, $1.55 million in 2025 — sharing continued after opt-out

Maryland breaks the pattern

Maryland is where the shared template stops holding. Most states allow sensitive data to be processed, and sold, once you have consent. Maryland bans the sale of sensitive data outright — no consent box redeems it, and layers on a strict data minimization standard that limits collection to what is reasonably necessary to provide the specific product or service the consumer asked for.

For a website, that changes the question. Consent tooling assumes the answer to “may we?” is sometimes yes. Under a flat prohibition, the answer for one category is no, whatever the visitor clicked. A banner cannot fix that; a data flow can. Know which of your tags touch health, precise location, or anything adjacent before you assume consent covers you.

Maryland is also a preview. States copied each other for four years; now they are starting to differentiate, and the differences land on specific data types and specific defaults rather than on the overall shape. Plan for divergence to arrive one clause at a time, and check the current statutory text with counsel before relying on any summary, including this one.

Build for behavior, not a state list

The instinct is to write the list into your code: these states get the opt-out link, these get the sensitive-data prompt, these honor GPC. The list was accurate the week you wrote it. Legislatures have moved several times since. Hard-coded jurisdiction logic is a maintenance liability with a slow fuse. It fails quietly, on someone else's browser, months after anyone remembers writing it.

The durable approach is to define behaviors, not jurisdictions. Honor GPC everywhere in the US rather than in twelve places. You are generally free to be more protective than the floor, and it removes a whole class of geo-detection bugs. Keep the opt-out link visible sitewide. Treat sensitive-category tags as off until someone affirmatively turns them on, wherever the visitor happens to be.

Geo-targeting still earns its place. An EEA visitor needs prior opt-in under GDPR and ePrivacy — nothing non-essential fires first, and regulator guidance from the EDPB adds that rejecting must be as easy as accepting. The UK runs on UK GDPR plus PECR, now diverging under the Data (Use and Access) Act 2025, which raised PECR fines to UK GDPR levels. Use region to raise the floor, never to lower it.

Google Consent Mode v2 belongs on the same list: required since March 2024 for Google advertising and measurement features covering EEA and UK users, with four signals to pass — ad_storage, analytics_storage, ad_user_data, ad_personalization. UserGuard is designed to emit all four. It is not a Google-certified CMP, and IAB TCF validation is roadmap, not a shipped feature.

Records are the part people forget

Every one of these regimes eventually asks the same question: show me. Show me what you disclosed, what the visitor chose, when, and what your site did next. GDPR Article 7(1) says it outright. You have to be able to demonstrate consent, and US enforcement gets there by way of records too. That is a records problem more than a banner problem, and it is the part that gets deferred because nothing visibly breaks when you skip it.

UserGuard is built around that. Consent events are tied to the site, the banner version the visitor actually saw, the region applied, and a timestamp, and they export to CSV so the record leaves the platform in a form a lawyer can read. Scanning runs through an evidence gate: a record becomes a cookie only when there is a Set-Cookie header, an HTTP-only record, or a document.cookie value. Everything else stays labeled context.

No tool makes anyone compliant, and UserGuard does not claim to. The obligations sit with you, and counsel who knows your business should read the statutes that actually apply to it. What software is built to do is narrow the gap: wire the opt-out to something that fires, honor the signal by default, and keep the record without anyone having to remember. UserGuard is newly launched, so that describes design intent, not a track record.

That is why GPC handling and geo-targeting are never paywalled. Charging extra for the mechanism regulators keep fining people over would be a strange way to run a privacy company. Every feature sits on every tier — accessibility widget included per site, which is a tool and not a compliance certificate — at $10 per site per month, with automatic volume discounts as you add sites (current rates).

Go deeper: US state coverage, plainly stated · region-aware banners