One setup for every state
Velo applies opt out defaults across the United States, so you do not maintain a banner per state as new laws take effect.
US state privacy laws,
one consent layer.
States such as Colorado, Connecticut, Virginia and Texas now give residents the right to opt out of targeted advertising, and several require sites to honour universal opt out signals.
The rule,
at a glance.
General information, checked September 2026. Not legal advice.
- Applies to
- Businesses that meet each state's thresholds, usually based on how many residents' data they process.
- The laws
- Virginia, Colorado, Connecticut, Utah, Texas, Oregon and more, each with its own privacy act.
- Consent model
- Opt out of targeted advertising, sale and certain profiling. Sensitive data usually needs opt in.
- Enforced by
- State attorneys general, in Colorado also district attorneys, and in California the California Privacy Protection Agency.
- Velo default
- Opt out across the United States, with Global Privacy Control honoured.
What state laws ask.
What Velo does.
Universal opt out signals
Several states require sites to honour signals like Global Privacy Control. When a browser sends GPC, Velo turns the advertising signals off automatically.
Records you can show
Each decision gets a receipt id, with the region and the GPC state at the time, so a request can be answered later.
A clear way to say no
Visitors can reject advertising and tracking from the banner and reopen their preferences from the floating button at any time.
What the law
actually says.
Since Virginia's law took effect in 2023, state after state has passed its own privacy act. Thresholds and details differ, but most share a core: residents can opt out of targeted advertising, the sale of their data and certain automated profiling, and a business has to give them a clear way to do it.
A growing group, including Colorado, Connecticut, Texas, Oregon and Montana, also requires sites to honour universal opt out signals such as Global Privacy Control. Sensitive data, such as health information or precise location, generally needs opt in consent instead.
Up and running
in four steps.
From the first script tag to the first recorded choice.
-
Add Velo to your site
Install it with the Google Tag Manager template or paste one script tag. Guides cover WordPress, Shopify, Webflow and other platforms.
-
Scan and sort your cookies
Velo scans your pages, lists the cookies and scripts it finds and suggests a category for each one. You confirm or change them.
-
Design the banner
Pick colours, wording and languages. Reject sits next to accept on the first layer.
-
Publish and check
Visitors in the United States get opt out defaults, and Global Privacy Control switches advertising off. Each choice lands in your consent log with its receipt id.
Before you
go live.
Velo handles the banner, the regional defaults and the records. These parts stay with you.
- Your privacy or cookie notice names each purpose and each third party that sets cookies.
- Tags in Google Tag Manager wait for the matching consent signal before they fire.
- You tested from the region itself: nothing optional loads before a visitor chooses.
- Someone on the team reviews new scripts when a scan finds them.
- Your privacy notice explains how residents can opt out and, in states that require it, how to appeal a refused request.
In every plan, from €0
Consent Mode v2 advancedRegional defaults by countryGlobal Privacy Control honouredReceipt for every choiceReject as easy as acceptFloating preferences button
Nine banner languagesCookie and tracker scanChoices by categoryConsent log and dashboardWorks with Google Tag ManagerInstallation help
Questions,
answered.
What teams ask about state privacy laws.
Which states have comprehensive privacy laws?
The list keeps growing. It includes California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and about a dozen others, each with its own thresholds and effective dates.
Do these laws require opt in consent for cookies?
Generally no. Most give residents the right to opt out of targeted advertising, the sale of personal data and profiling. Sensitive data is the main exception, where several states require opt in consent.
Which states require honouring Global Privacy Control?
Several do, including California, Colorado, Connecticut and Texas, and more states are adding universal opt out requirements. Velo honours GPC for United States visitors who send it.
Is this legal advice?
No. This page is general information. Thresholds and obligations differ by state, so check which laws apply to you.
Website privacy, in one place.
Scan your site →
Regulations
GDPR
UK GDPR
CCPA / CPRA
US state laws
LGPD
Ley 1581 (Colombia)
Ley 25.326 (Argentina)
Ley 29733 (Peru)
