State privacy laws and ad tracking: one setup for every state

US state privacy laws give visitors the right to opt out of targeted advertising, which means your ad pixels must stop when someone opts out or sends a universal opt-out signal, and sensitive data needs opt-in consent. Beyond California, states such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon have comprehensive privacy laws in force, and more states keep adding them.

The laws differ in thresholds and details, but their rules for website tracking are similar. This guide explains the common core, the differences that matter for tags, and one Google Tag Manager setup that covers them. This article is not legal advice.

Which US state privacy laws affect website tracking?

Comprehensive state privacy laws affect website tracking whenever a business meets the state's applicability thresholds. Most laws count the number of state residents whose personal data a business processes in a year, often with a lower number for businesses that earn revenue from selling data. Texas uses a different approach and reaches companies of almost any size unless they are small businesses as defined by the US Small Business Administration.

Even if your business is below a threshold today, the setup described here is worth doing. Thresholds are crossed quickly by a growing online shop, new states keep passing laws, and the major ad platforms increasingly expect sites to pass consent and opt-out states with every event. Building the opt-out once is cheaper than adding it state by state.

California's CCPA follows a similar idea with its own terms, such as sharing for cross-context behavioral advertising, and requires businesses to honor opt-out preference signals. Washington's My Health My Data Act is not a general privacy law, but it requires consent for collecting consumer health data, which can include tracking on health-related pages.

What do state privacy laws require for targeted advertising?

State privacy laws require that consumers can opt out of the processing of their personal data for targeted advertising, for the sale of personal data and for certain profiling. Targeted advertising usually means showing ads based on data collected over time across unaffiliated websites or apps, which is exactly what retargeting pixels and ad audiences do.

• A clear opt-out method, typically a link in the footer and in the privacy notice
• Recognition of universal opt-out signals such as Global Privacy Control in states that require it
• Opt-in consent before processing sensitive data in most states
• A privacy notice that names the categories of data, purposes and third parties
• No dark patterns: choices must be presented in a fair way

Several states also expect documentation. Virginia, Colorado, Connecticut and others require a data protection assessment for processing that carries higher risk, and processing for targeted advertising is on that list in most of them. For a marketing team, the assessment starts with the same tag inventory you need anyway: which pixels run where, what they send, to which platform and for which purpose. Keep it current, because a new plugin can add a tag without anyone noticing.

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

Universal opt-out signals: Colorado and the states that followed

A universal opt-out mechanism is a signal the browser sends to every site, and Colorado was the first state to require businesses to honor one. The Colorado Attorney General recognized Global Privacy Control (GPC) as the first approved mechanism, with the obligation applying since July 1, 2024. Connecticut, Texas, Oregon and other states have similar requirements, and California treats GPC as a valid opt-out under the CCPA.

For a website, the practical consequence is simple: if a browser sends GPC, treat the visitor as opted out of targeted advertising and sale of data. Detecting the signal costs one small variable in Google Tag Manager, and applying it nationwide is far easier than checking the visitor's state first.

Sensitive data: where ad tracking needs opt-in

Sensitive data is where US state laws move from opt-out to opt-in. Most of them require consent before processing data such as health information, precise geolocation or data revealing religious beliefs or sexual orientation. A pixel on a page about a medical treatment, a pregnancy test or a support group can transmit exactly this kind of information through the page URL or event names.

A typical case: a dental clinic group running Google Ads and Meta campaigns had conversion tags on its appointment pages, with treatment names in the URLs. Removing advertising tags from treatment pages, keeping only a generic conversion event without details on the confirmation page, and checking that URLs passed to tags contain no health terms reduced the risk considerably.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

One Google Tag Manager setup for all states

One Google Tag Manager setup can cover all of these laws if it follows the strictest rule for each point. Use Google Consent Mode with advertising granted by default for US visitors, an opt-out link that updates ad_storage, ad_user_data and ad_personalization to denied, and a GPC check on the Consent Initialization trigger that does the same. Store the opt-out so it persists across visits.

Add exception triggers so Meta, TikTok, LinkedIn and Pinterest tags never fire after an opt-out, and keep advertising tags off pages that touch sensitive topics unless you collect opt-in consent there. Visitors from Quebec or the European Union need a stricter default with advertising denied until consent, which Consent Mode handles with separate region settings.

See what your site loads before and after consent

The quickest way to find gaps is to look at what really loads. The free Trackum check at trackum.app/check opens your homepage three times in a real browser, with the banner unanswered, refused and accepted, plus two subpages, and lists the tags and cookies in each consent state, without sign-up. If you want the setup done for you, Trackum installs Google Tag Manager, GA4 and Consent Mode v2 for a fixed €150 one-time, each ad platform with conversion tracking for €50, tested with and without consent. Prices plus VAT.