The US state privacy patchwork, mapped for site owners

How many US states have privacy laws?

As of 2026, nineteen or more comprehensive state privacy laws are in force, with Indiana, Kentucky and Rhode Island among the recent additions. That number sounds chaotic, but it mostly isn't. Outside California, nearly all of them are built on the same template Virginia set in 2021, so once you know the template, you aren't dealing with nineteen separate problems.

The template works like this. Processing is generally permitted with notice, so no banner has to block anything up front. Consumers get a right to opt out of targeted advertising, sale and certain profiling. Sensitive data flips to opt-in, requiring consent before processing. That covers precise geolocation, health, biometrics, race, religion and sexual orientation, and in several states citizenship status and children's data too. Rights to access, correct, delete and appeal come standard.

California is the outlier everyone knows about. CCPA as amended by CPRA is an opt-out regime. Where it reaches your business, you owe a notice at collection, a working “Do Not Sell or Share My Personal Information” mechanism, and mandatory honoring of Global Privacy Control signals. If you treat it as a cookie consent law, you have it backwards and you'll build the wrong interface.

Universal opt-out signals and enforcement

Twelve states require honoring universal opt-out signals. In practice that means GPC, a header and a JavaScript property the browser sends with the request, before your page renders. There's no popup and nothing to click. Either your site reads it and suppresses sale and sharing or it doesn't, and anyone with developer tools open can see the failure.

That visibility is why the signal shows up in enforcement so often. California regulators have pursued it repeatedly, and the cases come down to mechanics: a control that existed but didn't work, or that worked more slowly and awkwardly than the path toward saying yes. None of this is legal advice, but the pattern is easy to see.

Todd Snyder's $345,178 penalty in 2025 is one more example, over a misconfigured banner that closed before it could take the request. Nobody was arguing about interpretation, because the button didn't do what it was supposed to. Test your opt-out path the way you'd test checkout, with the signal set and cookies cleared, on a live page, watching the network tab.

• Sephora, $1.2 million in 2022, for ignoring GPC signals
• Honda, $632,500 in 2025, for making opting out harder than opting in
• Healthline, $1.55 million in 2025, for sharing that continued after opt-out

Which state breaks the pattern?

Maryland, which is where the shared template stops holding. Most states allow sensitive data to be processed, and sold, once you have consent. Maryland bans the sale of sensitive data outright, even with consent. It also adds a strict data minimization standard that limits collection to what's reasonably necessary to provide the specific product or service the consumer asked for.

For a website, that changes the question. Consent tools assume the answer to “may we?” is sometimes yes. Under a flat prohibition, the answer for one category is no, whatever the visitor clicked. A banner can't fix that, so you have to change the data flow. Find out which of your tags touch health, precise location or anything adjacent before you assume consent covers you.

Maryland is also a preview. States copied each other for four years and are now starting to differentiate, mostly on specific data types and specific defaults while the overall shape stays the same. Expect the differences to arrive one clause at a time, and check the current statutory text with counsel before relying on any summary, including this one.

Build around behaviors instead of a state list

Your first instinct may be to write the list into your code, so that these states get the opt-out link, these get the sensitive-data prompt, and these honor GPC. That list was accurate the week you wrote it, and legislatures have moved several times since. Hard-coded jurisdiction logic gets harder to maintain over time, and when it fails nobody notices, because it happens on someone else's browser, months after anyone remembers writing it.

What holds up better is defining behaviors instead of jurisdictions. Honor GPC everywhere in the US instead of in twelve places. You're generally free to be more protective than the legal minimum, and it removes a whole class of geo-detection bugs. Keep the opt-out link visible sitewide. Treat sensitive-category tags as off until someone affirmatively turns them on, wherever the visitor happens to be.

You still need geo-targeting. An EEA visitor needs prior opt-in under GDPR and ePrivacy, so nothing non-essential fires first, and regulator guidance from the EDPB adds that rejecting must be as easy as accepting. The UK runs on UK GDPR plus PECR, now diverging under the Data (Use and Access) Act 2025, which raised PECR fines to UK GDPR levels. Use a visitor's region to add protections, and never to remove them.

Google Consent Mode v2 belongs on the same list. It's been required since March 2024 for Google advertising and measurement features covering EEA and UK users, and there are four signals to pass: ad_storage, analytics_storage, ad_user_data and ad_personalization. UserGuard is designed to send all four. It isn't a Google-certified CMP, and IAB TCF validation is on the roadmap and hasn't shipped.

Records are the part people forget

Every one of these regimes eventually asks you to show what you disclosed, what the visitor chose, when, and what your site did next. GDPR Article 7(1) says it outright: you have to be able to demonstrate consent. US enforcement gets there by way of records too. That's a records problem more than a banner problem, and it gets put off because nothing visibly breaks when you skip it.

UserGuard is built around that. Consent events are tied to the site, the banner version the visitor saw, the region applied and a timestamp, and they export to CSV, so you can take the record out of the platform in a form a lawyer can read. Scanning runs through an evidence gate, which means a record becomes a cookie only when there's a Set-Cookie header, an HTTP-only record, or a document.cookie value. Everything else stays labeled as context.

No tool makes anyone compliant, and UserGuard doesn't claim to. The obligations sit with you, and counsel who knows your business should read the statutes that apply to it. Software can narrow the gap by connecting the opt-out to something that fires, honoring the signal by default, and keeping the record without anyone having to remember. UserGuard is newly launched, so that describes what we designed it to do, and we don't have a track record yet.

That's why GPC handling and geo-targeting are never paywalled. It would be a strange way to run a privacy company if we charged extra for the mechanism regulators keep fining people over. Every tier has every feature at $10 per site per month, with automatic volume discounts as you add sites (current rates). That includes an accessibility widget for each site, which is a tool and doesn't certify compliance.

Go deeper: US state coverage · region-aware banners