Cookie Banner Requirements: What US Law Requires and What a Banner Cannot Do

The California regulations never tell a business to display a banner. They tell a business that sells or shares personal information to provide methods for people to opt out, to post a specific link or an approved alternative, and to process opt-out preference signals. Colorado's and Connecticut's Attorneys General describe their laws in the same opt-out terms.

The research notes behind this article draw the same conclusion as an inference: US state privacy law is opt-out for most data, so a tag firing before a banner click is not by that fact alone a violation of those acts. The notes add that the legally strongest finding against a US site is that it ignores opt-outs.

Two cautions apply. Each state law covers only businesses above its thresholds. And other laws can apply to particular kinds of data, which this article does not review. This article describes what the sources say and is not advice about a particular site.

Section 7026 says a business that sells or shares personal information 'shall provide two or more designated methods for submitting requests to opt-out'. A business that collects personal information online must, at a minimum, accept an opt-out preference signal and offer at least one more method. The regulation lists an interactive form reached through the 'Do Not Sell or Share My Personal Information' link, the alternative opt-out link, or the privacy policy where the business processes signals in a frictionless manner.

Section 7013 describes the link. It must be conspicuous and located in the header or footer of the homepage. Clicking it must either opt the person out immediately or take them to a page where they can make that choice.

The methods have to be easy. The business may not require an account or more information than is needed, and may not require a verified request. Once a request arrives, the business must stop selling and sharing 'as soon as feasibly possible, but no later than 15 business days', and must notify the third parties that received the data.

The text quoted in this article is the version published by Cornell's Legal Information Institute. The privacy agency has amended its regulations since then, so check the agency's current text before relying on a subsection number.

The sentence is in section 7026(a)(4): 'A notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of sale/sharing because cookies concern the collection of personal information and not the sale or sharing of personal information.' It continues that an acceptable method 'must address the sale and sharing of personal information'.

The Sling TV settlement shows the rule applied. The Attorney General's announcement says Sling TV 'combined cookie preferences with the CCPA opt-out, even though to truly opt-out, turning off cookies was insufficient'. People had to find an embedded link to a web form and click through confirmation steps. Under the settlement Sling TV must stop directing people who want to opt out to cookie preferences. The settlement included $530,000 in civil penalties and was subject to court approval when announced.

The practical reading is that a banner can sit in front of an opt-out system. It cannot be the whole system. Data can be shared through routes a cookie toggle does not reach, and the regulation expects the opt-out to cover the sharing itself.

Section 7004 sets design principles for any method of submitting a privacy request or obtaining consent. The central one is symmetry in choice: the path to the more privacy-protective option 'shall not be longer or more difficult or time-consuming' than the path to the less protective one.

The regulation gives a banner as an example. A website banner offering only 'Accept All' and 'More Information', or 'Accept All' and 'Preferences', is 'not equal or symmetrical' because one click accepts everything while declining takes extra steps. It says an equal choice could be between 'Accept All' and 'Decline All'.

The section ends with the consequence. A method that does not follow these principles 'may be considered a dark pattern', and agreement obtained through dark patterns does not count as consent.

The five matters below come from the regulators' own announcements, except PlayOn Sports, which is taken from a WilmerHale summary of the agency's decision because the agency's page could not be opened.

In the Todd Snyder decision the privacy agency's head of enforcement, Michael Macko, said: 'Using a consent management platform doesn't get you off the hook for compliance.' The agency's announcement adds that businesses should scrutinize their privacy management tools to make sure they work as intended.

Colorado's Attorney General says that since 1 July 2024 businesses within the Colorado Privacy Act's thresholds must allow people to opt out of the sale of personal data or its use for targeted advertising using Global Privacy Control. Businesses must also explain in their privacy policy how requests made through such mechanisms are processed.

Connecticut's Attorney General says a controller must provide an easily accessible link on its website through which people can opt out of targeted advertising or the sale of their personal data. Since 1 January 2025, controllers must also honor opt-out preference signals.

These two are examples. The California privacy agency wrote in October 2025 that about a dozen states require businesses to honor opt-out signals. Each law has its own scope and wording, and this article did not review the rest.

The audit is from InfoTrust, which sells consent and analytics services. It reported that the typical site fired 25 tracking tags before any consent interaction, that nearly one in four sites made no change at all based on the visitor's choice, and that the median site kept sharing data with five advertising or analytics vendors after an opt-out. The public page does not describe how sites were chosen or how tags were detected.

These are one vendor's numbers for one sample. They line up with the regulator cases, which describe controls that looked correct and did not work. A banner is an interface. Whether a tag stops depends on how that tag was installed and whether the banner is wired to it.

The research notes record one cause from a vendor guide: a pixel hard-coded into a page can fire before the tag manager loads, so consent settings in the tag manager may not stop it. That is a single vendor's explanation, and it matches the kind of gap the Todd Snyder and Healthline matters describe.

The list follows the California sections quoted above and the facts of the cases. It is a way to compare a banner with what the sources describe. It is not a statement of what any particular business must do.

• Confirm the site has an opt-out method that addresses sale and sharing, reachable from a 'Do Not Sell or Share My Personal Information' link or an approved alternative.
• Confirm the site processes a browser opt-out signal with no banner interaction.
• Count the clicks to accept and the clicks to decline. They should be equal.
• Read each button and toggle aloud. Remove double negatives and bare on and off labels.
• Decline, reload, and record which advertising and analytics tags still load.
• Check tags placed outside the tag manager, which a banner may not control.
• Confirm no screen forces agreement before a visitor can use something they already paid for.
• Retest after every change to tags or the consent tool, and keep the dated result.