Which US states make you honour a browser opt-out signal

On this page

1. The seven positions we read directly, and what each one says
2. The signal doesn't tell you which state the visitor is in
3. One global rule is wrong in both directions
4. "Honouring" the signal means more than the banner registering it
5. The area is unsettled, and the honest version says so
6. Checking your own setup, one region at a time
7. What to do with this before the next state lands

Short answer: several US states require you to treat a browser opt-out signal as a legal opt-out, and Global Privacy Control is the only signal anyone actually sends — Colorado's regulator lists it as the sole recognised mechanism. The duty is defined state by state, and the signal itself carries no geography, so a single global rule in your consent platform is either ignoring the law somewhere it binds or suppressing advertising data in states where nothing required it. Configure the rule per region, and check each region separately. This is a fast-moving area of law and none of it is legal advice.

The seven positions we read directly, and what each one says

Every row below comes from that state's own statute text or its attorney general's page, read on 23 September 2026. We've deliberately not reproduced anyone's compliance matrix — those go stale quietly, and several of the ones in circulation disagree with each other. This isn't the full map of US state privacy law either; more states have comparable duties, and the list grows most legislative sessions.

Two things in that table do more work than the row count. Colorado runs the only formal register — CPA Rule 5.07 has the Attorney General "maintain a public list of Universal Opt-Out Mechanisms that have been recognized to meet the standards of this subsection", and as at 23 September 2026 that list holds Global Privacy Control and nothing else, with the department stating that GPC "is the only UOOM considered valid". Everywhere else the statute describes a category and leaves you to decide what falls in it.

And Texas is conditional in a way the others aren't. Section 541.055(e) requires a controller to honour an agent's opt-out, then lists when it doesn't have to: where the request isn't communicated clearly, where the controller can't verify with commercially reasonable effort that the consumer is a Texas resident, where it lacks the ability to process the request, or where it doesn't process similar requests under other states' laws.

The signal doesn't tell you which state the visitor is in

Global Privacy Control arrives as an HTTP header and a JavaScript property. Neither carries a location. Your own geolocation decides which rule applies — which means the accuracy of your geo lookup is now the thing that determines whether a legal duty attaches to a given request.

The statutes are aware of this and push it onto you. Montana requires that the mechanism "allow the controller to accurately determine whether the consumer is a resident of the state". Oregon's text operative from 1 January 2026 requires the same for Oregon residents. Texas makes inability to verify residency an express ground for not complying.

The practical consequence: a VPN exit, a corporate proxy or a mobile carrier's routing can place a genuine Colorado resident in Illinois as far as your consent platform is concerned. There's no way to resolve that from the signal, and no regulator has published a tolerance for how wrong your geolocation may be. If you want a defensible position, log the vantage you inferred alongside the decision you made, so a later question about one visitor has an answer.

One global rule is wrong in both directions

The tempting fix is a single rule: honour the signal everywhere, and stop worrying about which state anybody is in. It's the wrong shape, and it costs in the direction people don't count.

In a state with an opt-out statute, the default is that data flows. Suppression applies to people who opted out and people sending a recognised signal — nobody else. Suppress everywhere and you have withheld advertising data across every state where nothing required it, including states with no comprehensive privacy law at all. That's a measurable loss of conversion coverage bought for no legal benefit.

The mirror failure is worse and quieter. A rule that is global in name but attached to one banner will miss the regions served by your other banners. Google's tag API is built for the per-region version of this: defaults can be set per region, and the more specific region wins, so US and US-CA can carry different values and the Californian visitor gets the Californian rule (Google, consent mode documentation, checked 23 September 2026). If your consent platform can't express that shape, it can't express the law.

"Honouring" the signal means more than the banner registering it

The consent platform recording an opt-out is the start of the work. Technically the duty only lands when the visitor's choice reaches every place their data actually goes.

There are four, and they fail independently:

1. The web container. Tags in Google Tag Manager only respect consent if consent is wired into them — a Consent Mode default that runs before the container, plus consent checks on the tags themselves.
2. The server container. A request arriving at server-side tagging has lost the browser context unless you deliberately forwarded the consent state with it. See what splits between client and server dispatch for what does and doesn't carry across that boundary.
3. Platform-side flags. On Google's side the relevant control is restricted data processing. Google states that in applicable states it receives GPC signals directly and triggers restricted data processing for those ad requests, and that partners who implement GPC may also send a restricted data processing parameter themselves (Google Ads Help, checked 23 September 2026). Restricted data processing is a limitation rather than a blackout: remarketing list additions stop while conversion tracking and campaign measurement continue.
4. Scheduled exports. Customer lists and audience uploads leave on a timer, not on a pageview. A suppression that holds in the browser and fails in tonight's upload is not a suppression.

Consent Mode is the mechanism that carries the state into Google's tags once it exists; it does not decide what the state should be. If you're choosing between its two implementations, Basic and Advanced behave differently in what they send when consent is denied, and that's a separate decision from this one.

The area is unsettled, and the honest version says so

Statutes here change every session, effective dates land mid-year, and amendments quietly restate provisions you already implemented — the Connecticut duty, for one, has been revisited by later legislation, so read the current text rather than a summary written when it passed. Regulators are also still working out what enforcement looks like: Colorado's register can be updated, and the department says explicitly that the list doesn't exclude other mechanisms from meeting the requirements now or in the future.

Where a state's position looks ambiguous to us, we've said so rather than resolving it in the direction that makes a neat table. Nothing here is legal advice, and a US privacy lawyer should sign off the rules you actually deploy. What we can tell you is which configuration produces which behaviour, and how to verify the one you have.

Checking your own setup, one region at a time

Do this in a fresh private window for each pass — a stored consent record from an earlier visit suppresses the banner and hands you a false pass.

1. Enumerate your banners. Not the default one. Every geo rule your platform serves, with the regions each covers.
2. Read the signal setting on each. This is the checkbox from the section above. It's per banner in most products, and that's the fault we find most often.
3. Turn the signal on in a browser that sends it. Firefox exposes it in about:config; Brave and DuckDuckGo's browser have it in privacy settings.
4. Load from each region separately. A test from the wrong region tells you about the wrong banner. This is the step that hides the fault.
5. Read the consent state, then watch the network. If the state says opted out and your tag endpoints still fire, the platform registered the opt-out and nothing downstream acted on it.
6. Then check what leaves on a schedule. Confirm that a suppressed visitor is also absent from the next customer-list export.

If your reporting on the other side matters, conversion tracking under consent covers what Google Ads does with the gap and what it doesn't.

What to do with this before the next state lands

Treat the region rule as the unit of work, not the account. Enumerate the banners, confirm the signal setting on each, test one visit per region, and follow the choice past the consent layer into the server container and the scheduled exports.

Then write down which rule covers which states and why, with the date you checked each statute. The list will change — that's the nature of this area — and a dated note is the difference between a twenty-minute review next session and starting over.

If your consent platform can't hold a different rule per region, that's a procurement problem rather than a configuration one, and the five checks worth running on a replacement start there.

If you'd like the per-region check run properly across an estate, with the downstream path followed rather than assumed, that's the work we do.

Sources

1. 1.California Attorney General — Global Privacy Control (GPC) under the CCPA · Checked 2026-09-23
2. 2.Colorado Attorney General — Universal Opt-Out and the Colorado Privacy Act, including the recognised-mechanism list · Checked 2026-09-23
3. 3.Connecticut General Assembly — General Statutes chapter 743jj, Data Privacy and Security · Checked 2026-09-23
4. 4.Montana Code Annotated 2025 — 30-14-2809, Authorized agent · Checked 2026-09-23
5. 5.New Jersey Legislature — P.L.2023, c.266 (enacted text, section 9) · Checked 2026-09-23
6. 6.Oregon Revised Statutes 646A.578 — Duties of controller (text operative 1 January 2026) · Checked 2026-09-23
7. 7.Texas Legislature — House Bill 4, 88th Regular Session, enacted text (Bus. & Com. Code § 541.055) · Checked 2026-09-23
8. 8.Google Ads Help — Helping advertisers comply with the U.S. states' privacy laws in Google Ads · Checked 2026-09-23