US privacy law atlas. Every law that reaches you

No. The regulation says so directly.

"A notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of sale/sharing…"

11 Cal. Code Regs. § 7026(a)(4), in force since March 2023

The two regimes are built on opposite defaults. EU-born cookie consent is opt-in: rejecting a GDPR banner is an affirmative withholding of consent. US state law is opt-out: not interacting with a banner is simply not having opted out. A control designed for the first does not perform the job of the second.

The Disney final judgment (¶ 29) moved this from regulatory text to a court-ordered prohibition on choice architecture that conflates cookie preferences with the sale/share opt-out.

Almost certainly, through "share" rather than "sell."

Cal. Civ. Code § 1798.140(ad) defines "sell" as disclosing or making personal information available to a third party "for monetary or other valuable consideration." Section 1798.140(ah) separately defines "share" as the same range of disclosures made for cross-context behavioral advertising, regardless of whether money changes hands.

Most ad tech relationships trigger the share definition well before they would satisfy the narrower sale test. Both definitions cover online data (pixels, cookies, ad-tech identifiers) and offline data (account records, email and phone identifiers moved by file transfer or API).

That carve-out is real, but most ad tech relationships fail it.

A third party that receives data solely to perform a service for the business, under a contract carrying the CCPA-required provisions, can be a service provider rather than the recipient of a sale or share. That is the first exception lawyers reach for, and it holds for genuine processors.

It does not usually hold for the ad platforms. Vendors like Facebook, Google, and The Trade Desk independently use the data for their own commercial purposes, including cross-context behavioral advertising. A vendor that uses your data to improve its own models or build its own audience segments is acting as a business, not a service provider, and the transfer is a sale or, more often, a share.

The CCPA's definition of "business" is entity-based, not transaction-based. Any entity that independently meets the statutory thresholds and engages in sale or sharing is a business in its own right, whether or not it ever touched the consumer directly.

Blocking a tag stops future collection. The obligation reaches data the vendor already holds.

Cal. Civ. Code § 1798.120(d) makes a business "prohibited" from selling or sharing after it receives an opt-out, and the obligation runs to ongoing flows of data already collected, not only to new collection. A consumer's year or more of historical data still sits inside vendor audiences, targeting segments, and trained models after the tag stops firing.

Three flows make this concrete, and none of them consult a browser signal: server-to-server API transfers to enrichment and identity providers; offline file or API feeds of CRM, loyalty, and purchase data; and hashed-identifier uploads into data clean rooms and identity graphs. In each, "we stopped the tag" is true and "we stopped the sale or share" is false.

Healthline is the enforcement example: the consent banner disabled cookies while data sharing with ad-tech partners continued despite opt-outs and GPC signals.

Yes, and directing them to comply is part of the requirement.

Under 11 Cal. Code Regs. § 7026(f)(2), a business must notify every third party it has sold or shared that consumer's data to and direct them to comply. Cal. Civ. Code § 1798.115(d) and 11 Cal. Code Regs. § 7052(a) then obligate those downstream entities to cease further selling or sharing. This is statutory text, not interpretation.

The practical difficulty is well documented: emailing a vendor's privacy alias is not a mechanism anyone processes at scale, and ad tech chains run several links deep past the point where a business holds a direct contract. A retailer contracts with an agency; the agency uses a DSP the retailer has no privity with; the DSP's exchange placement triggers piggyback tags from firms the retailer never knew were involved. The retailer stays accountable for a failure five links down.

How flow-down must be technically effectuated is statutory-untested: no primary enforcement action yet centers on the mechanics.

Fifteen business days under the California regulations.

Cal. Civ. Code § 1798.120(a) lets a consumer direct a business to stop selling or sharing their personal information at any time. Under 11 Cal. Code Regs. § 7026(f)(1), the business must comply "as soon as feasibly possible, but no later than 15 business days."

Other states set their own clocks. The New Jersey Data Privacy Act § 9(a)(6), for example, requires consent revocation to be at least as easy as giving consent, with processing ceasing no later than 15 days after the request. Check the individual entries below for the state you need.

Under the California regulations and the Disney judgment, yes.

Under 11 Cal. Code Regs. § 7025(c)(1), when a business receives an opt-out preference signal and the consumer is known, logged in, identifiable through a hashed identifier, or linkable by any reasonable means, it must honor the opt-out across every context where it sells or shares that consumer's data, including associated pseudonymous profiles.

"The investigation found that Disney's opt-out processes did not allow a consumer — even when logged into their account — to completely opt out of and stop all sale or sharing of their data, in violation of the CCPA."

California AG press release, February 2026

The judgment (¶ 26) requires account-wide, cross-property effectuation for logged-in consumers. For consumers with no account, it requires treating the opt-out as applying to "that browser, application, or device and any consumer profile… including pseudonymous profiles."

Any second step. Four California enforcement actions turn on exactly this.

Honda: identity verification and unnecessary information, including VINs, demanded before an opt-out was honored. Ford: email verification first. Sling/Dish: logged-in users asked to re-submit information the business already held, and no native opt-out in its CTV apps. Disney: webform opt-outs honored only for Disney's own ad platform, not third-party ad tech.

"A consumer's opt-out right applies wherever and however a business sells data — businesses can't force people to go device-by-device or service-by-service."

California Attorney General, Disney matter

The operating principle: one opt-out request, honored comprehensively, across online and offline data, across devices, across downstream systems. This is the single most enforced issue in US privacy today.

Private litigation on a track entirely separate from any regulator.

CIPA is a California telephone wiretapping statute now argued by plaintiff's firms to reach tracking pixels, session replay, and analytics scripts. Demand letters typically seek roughly $50,000 in settlement plus roughly $30,000 in legal fees, an approximately $80,000 problem per instance, and targeted companies report two to six per year. VPPA, the 1988 video rental privacy statute, is a distinct regime now applied to sites that share video-viewing data with ad platforms via pixels, and it carries a statutory private right of action.

The calibration that matters: CIPA and VPPA do not require a Do Not Sell mechanism, and the CCPA never required a tracking-disclosure banner. Conflating the two regimes produces the wrong remediation.

The same mechanics now recur state by state, with variations that matter.

Take the New Jersey Data Privacy Act (P.L. 2023, c. 266). Section 8(b)(1) requires honoring a universal opt-out mechanism. Section 7(b) imposes a forward-looking "remains deleted" standard, meaning future data ingestion has to be checked against a suppression record. Section 9(a)(6) requires consent revocation at least as easy as giving consent. Section 13(g) makes controller-versus-processor status a fact-based determination regardless of what the contract says.

Multiply that by every state entry in the atlas below. Universal opt-out signals, sensitive-data consent, deletion suppression, and processor flow-down each now exist in a dozen-plus variants. Scope your obligations above to see which ones reach you.

Far more than a name and an email address, and in California more than a person.

Most states use a short definition: information that is linked or reasonably linkable to an identified or identifiable individual. That phrasing is doing heavy lifting. A hashed email, a device identifier, an advertising ID, a cookie value, an IP address, all of them are reasonably linkable to a person in an ordinary marketing stack, so all of them are personal data.

California enumerates the categories, and the list is the useful part: identifiers including IP address and online identifiers; characteristics of protected classifications; commercial information including purchase histories and tendencies; biometric information; internet activity including browsing history, search history, and interactions with a website or advertisement; geolocation; audio, electronic, visual, thermal and olfactory information; employment and education information; and inferences drawn from any of it to create a profile.

Inferences are the category people miss. A conclusion your systems draw about someone is itself personal information about them, and it is covered even though no one ever collected it directly. California is also alone in covering households, not only individuals.

Four carve-outs sit outside the definition, and they are narrower than they sound:

Publicly available means lawfully available from government records, or lawfully made available to the general public by the consumer or through widely distributed media. California adds that biometric information collected without the consumer's knowledge is never publicly available.

De-identified is not a state of the data alone. California requires all three of: reasonable measures so the information cannot be associated with a consumer, a public commitment not to re-identify, and contractual obligations binding every recipient to the same. Miss one and the data is still personal information.

Aggregated means information about a group from which individual identities have been removed. California is explicit that a set of individually de-identified records is not aggregate information.

Pseudonymous data is generally still personal data. Holding the key separately reduces risk; it does not remove the obligation.

Not in California. They were, and the exemptions expired on 1 January 2023.

The CCPA once carved out personal information collected about someone acting as a job applicant, employee, owner, director, officer, medical staff member or independent contractor, and separately carved out business-to-business communications. Both carve-outs are still printed in the statute, which is the trap: each ends with its own kill switch. Section 1798.145(m)(4) and section 1798.145(n)(3) each read "This subdivision shall become inoperative on January 1, 2023." The Legislature let them lapse rather than repealing the text.

So in California an employee, applicant, contractor or business contact is a consumer, holding access, deletion, correction and opt-out rights over the data you hold about them. A privacy programme built around consumer web data covers none of that population, and the population is large: every HR record, every applicant tracking system, every CRM contact at a customer or vendor.

Other states generally reach the opposite result, but by a different route. Rather than an exemption, most define consumer to mean a person acting in an individual or household context and expressly exclude a person acting in a commercial or employment context. The effect is that employee and B2B data fall outside the law entirely. Because the mechanism sits in the definition rather than an exemptions section, checking it means reading each state's definition of consumer, not its exemptions list. We have not done that state by state, so treat the general pattern as a starting point and confirm the states that matter to you.

Entity-level and data-level exemptions are different things, and the difference decides how much work you do. A data-level exemption removes specific data while the organisation stays covered for everything else. An entity-level exemption removes the whole organisation. For the financial and health carve-outs the states split: several give financial institutions an entity-level exemption under Gramm-Leach-Bliley, while California and Oregon exempt only the data, and Connecticut removed its entity-level exemption by amendment. The same organisation can be fully exempt in one state and substantially covered in another for identical processing.

Other exemptions vary more than practitioners expect. Government entities are exempt almost everywhere. Non-profits are exempt in most states but in scope in Colorado and New Jersey, and in Montana, Nebraska, Minnesota and Delaware only insurance-fraud non-profits are exempt. Higher education is exempt in many states but in scope in California, Oregon, Delaware, New Jersey and Maryland.