The United States has no comprehensive federal privacy law, and there is no general US requirement to obtain opt-in consent before setting non-essential cookies, as EU law requires. Instead, privacy is regulated by federal laws covering specific sectors or groups, and by state laws. Several of these affect how websites use cookies and similar tracking technologies.
State Privacy Laws
Around 20 states have comprehensive consumer privacy laws in effect, and several more have been passed. Each law sets its own thresholds for which businesses are covered. Most give residents the right to opt out of the sale of their personal data and of targeted advertising, and many require consent before a business processes sensitive data. Virginia’s law, for example, gives consumers the right to opt out of targeted advertising, the sale of personal data and certain profiling, and requires consent before processing sensitive data.
Cookies and similar technologies used for targeted advertising can fall within these opt-out rights.
California
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives consumers the right to opt out of the sale or sharing of their personal information. “Sharing” means making personal information available to a third party for cross-context behavioral advertising, which can involve cookies and similar tracking technologies.
Covered businesses that sell or share personal information and collect it online must treat an opt-out preference signal, such as Global Privacy Control (GPC), as a valid request to opt out of sale and sharing. A business may not sell or share the personal information of consumers it knows are under 16 without opt-in authorization, given by the consumer if aged 13 to 15, or by a parent or guardian if under 13.
Children: COPPA
At federal level, the Children’s Online Privacy Protection Act (COPPA) applies to websites and online services directed to children under 13, and to operators that know they are collecting personal information from children under 13. These operators generally must obtain verifiable parental consent before collecting personal information from a child. Under the amended COPPA Rule, they must also obtain separate verifiable parental consent before disclosing a child’s personal information to third parties, for example for targeted advertising, unless the disclosure is integral to the website or service. Under the Federal Trade Commission’s COPPA rule, personal information includes persistent identifiers such as those held in cookies, subject to a narrow exception for supporting a site’s internal operations.
Visitors from the EU
A US website that offers goods or services to people in the EU, or monitors their behavior there, may also be subject to the EU’s General Data Protection Regulation (GDPR), and EU cookie consent rules may then be relevant to it.
Conclusion
US law does not generally require EU-style opt-in consent before cookies are set. But many state laws give residents the right to opt out of the sale of their data and of targeted advertising and require consent for sensitive data, California requires businesses that sell or share personal information to honor opt-out signals such as GPC, and COPPA requires verifiable parental consent before collecting personal information from children under 13, with separate consent for disclosures to third parties, such as for targeted advertising, unless they are integral to the service. The rules that apply depend on the business, its visitors and the states involved.
This article is general information, not legal advice.