US state privacy laws.
One setup.
California started it; a growing list of states followed, each with its own twist. Clickio Consent handles the whole wave through the IAB Global Privacy Platform: opt-out dialogs, correct signals to your partners, and Global Privacy Control honored automatically.
Trusted by 2,000+clients worldwide
US privacy laws at a glance
There is no single federal privacy law. Instead, a growing patchwork of state acts, led by California's CCPA/CPRA, now covers a large share of the US population.
Who it protects
Residents of enacting states California, Virginia, Colorado, Connecticut, Texas, Oregon and a steadily growing list
Consent model
Opt-out, not opt-in Visitors must be able to opt out of the sale/sharing of personal data and targeted advertising
Key mechanics
"Do Not Sell or Share" + GPC Universal opt-out signals like Global Privacy Control must be honored where states require it
Penalties
Per-violation fines e.g. up to $7,988 per intentional violation under CCPA/CPRA (the 2025 to 2026 inflation-adjusted figure; the statutory base is $7,500 and the CPPA re-adjusts it every two years), enforced by state AGs and the CPPA
This guide is general information for site owners, not legal advice. Check the current text of the law and your own counsel for your situation.
How Clickio handles the state-law patchwork
Instead of one integration per state, Clickio speaks the standard the industry agreed on: the IAB Global Privacy Platform.
Opt-out dialog, done right
US visitors see the notice and choices their state requires, including "Do Not Sell or Share My Personal Information", instead of an EU-style opt-in wall that doesn't fit US law.
GPP signals to every partner
Choices are encoded in the IAB GPP string (the successor to the old US Privacy string), so Google and every downstream partner receive the visitor's state-law status in the format they expect.
GPC honored automatically
Visitors using Global Privacy Control in their browser are treated as opted out where their state requires it: no dialog interaction needed, nothing left to configure.
One switch, and it scales with the map
- Enable US regulations from the Platform. Turn the US regime on alongside GDPR and any other regulation; each visitor is geo-matched to the rules that apply to them.
- New states without new projects. As more states enact laws, coverage arrives as configuration in Clickio's regulation catalog, not a development project on your side.
- Consistent with the rest of your stack. The same tag orchestration enforces US opt-outs on-page, and attribute gating can key on US privacy state for your custom tags.
- CCPA/CPRA (California): the strictest state regime, incl. GPC honoring
- GPP National coverage: one signal format spanning state acts
- Google compatibility: the signals Google reads for US traffic
- Combines with GDPR: EU visitors opt in, US visitors opt out, automatically
Frequently asked questions
How is US compliance different from GDPR?
The direction is reversed. GDPR requires opt-in consent before non-essential processing; US state laws let processing happen but require a clear way to opt out of sale/sharing and targeted advertising. Clickio shows each visitor the model their law requires: opt-in dialogs in Europe, opt-out notices in the US.
Which states does Clickio cover?
Clickio's US mode uses the IAB GPP national approach, which spans the enacted state laws: California's CCPA/CPRA plus the Virginia, Colorado, Connecticut, Texas, Oregon and subsequent acts. Check the regulation catalog in the Platform for the current list. As new states come online, coverage is added in Clickio's regulation catalog as configuration.
What is the GPP string?
The IAB Global Privacy Platform string is the standard container for privacy signals across jurisdictions; it replaced the older US Privacy (CCPA) string. Clickio encodes each US visitor's status into it so every ad partner downstream reads the same, correct signal. More on our GPP page.
Do I have to honor Global Privacy Control?
Several states, California among them, require universal opt-out signals like GPC to be treated as a valid opt-out. Clickio detects GPC and applies the opt-out automatically for visitors from those states.
Can I run GDPR and US compliance on the same site?
Yes, that's the point of Clickio's multi-regulation setup. Each visitor is geo-matched: EU visitors get the GDPR opt-in dialog, US visitors get the state-law opt-out experience, and you choose what everyone else sees via the fallback regulation.
What about my ad revenue from US traffic?
Opt-out regimes are gentler on monetization than opt-in ones: ads keep serving unless the visitor opts out, and correct GPP signals keep you eligible with Google and other partners. Incorrect or missing signals are what actually cost revenue.
Explore other regulations
Every guide shows how the same Clickio tag serves the right consent experience for that market. Pick the next one that applies to your audience.
GPP signals and US state-law dialogs are included from the Starter plan.
US state-law support through the IAB GPP starts on Starter, together with geo-specific settings and geo-specific vendor lists.