{"page":"/blog/cookie-banner-rules-by-country","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Jurisdiction","Legal basis","Consent for advertising cookies","Reject-button rule","GPC or browser signal","Regulator guidance","Notable enforcement"],"rows":[["US federal","No general cookie statute; COPPA Rule, 16 CFR 312.2 for children under 13","No general federal consent rule for adults; for children, cookie IDs are \"personal information\" and the internal-operations exception excludes behavioral advertising","None","None","n/d","n/d"],["California","Civ. Code § 1798.120; 11 CCR §§ 7004, 7025","Opt-out of sale or sharing; opt-in for consumers known to be under 16 (§ 1798.120(c))","\"Symmetry in choice\": the privacy-protective path may not be longer (§ 7004(a)(2))","Yes, qualifying signals are valid opt-outs (§ 7025(b)); browsers must offer one from January 2027 (AB 566)","CCPA regulations, effective 1 Jan 2026","Sephora $1.2 million, 24 Aug 2022 (AG); Honda $632,500, 12 Mar 2025 (CPPA); Healthline $1.55 million, 1 Jul 2025 (AG); Tractor Supply $1.35 million, 30 Sep 2025 (CPPA); Disney $2.75 million, 11 Feb 2026 (AG)"],["Colorado","Colorado Privacy Act","Opt-out of targeted advertising","n/d","Universal opt-out mechanisms honoured from 1 Jul 2024; GPC recognised (Colorado AG, via search)","Colorado AG rules (n/d date)","n/d"],["Connecticut","Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-517(b) as cited by the AG)","Opt-out of targeted advertising","n/d","Opt-out preference signals honoured from 1 Jan 2025 (CT AG)","CT AG CTDPA page","n/d"],["Oregon","Oregon Consumer Privacy Act (ORS 646A.570 et seq.)","Opt-out of targeted advertising","n/d","Opt-out signals honoured from 1 Jan 2026 (Oregon DOJ)","Oregon DOJ privacy page","n/d"],["Minnesota","Minnesota Consumer Data Privacy Act, in effect 31 Jul 2025 (MN AG)","Opt-out of targeted advertising","n/d","Universal opt-out mechanisms required (MN AG, 28 Jul 2025)","MN AG","n/d"],["Other US states","Comprehensive state privacy laws","Opt-out models","n/d","California's regulator counted \"a dozen states\" requiring signal recognition in October 2025 (CPPA); state-by-state dates not verified here","n/d","n/d"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/16/312.2"],["https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf","https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf","https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement","https://cppa.ca.gov/announcements/2025/20250312.html","https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155","https://cppa.ca.gov/announcements/2025/20250930.html","https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million"],["https://coag.gov/resources/colorado-privacy-act/"],["https://portal.ct.gov/AG/Sections/Privacy/The-Connecticut-Data-Privacy-Act"],["https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/"],["https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp"],["https://cppa.ca.gov/announcements/2025/20251008_2.html"]]}