United States

US privacy laws: opt-out rights, Global Privacy Control and record keeping

How the CCPA/CPRA and other US state laws differ from Europe, why Global Privacy Control (GPC) signals now matter, what records to keep, and how to use Macaw alongside them.

Last reviewed

What the law requires

Opt-out, not opt-in

US state laws such as the CCPA/CPRA follow an opt-out model: consumers must be able to opt out of the sale or sharing of their personal information and of targeted advertising. Several states, for example Colorado, Connecticut and Virginia, require opt-in consent for sensitive data, and children's data needs consent too.

Universal opt-out signals (GPC)

  • At least 12 states require honouring a universal opt-out mechanism such as Global Privacy Control: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas (as reported in 2026).
  • California, Colorado and Connecticut ran a joint enforcement sweep on ignored GPC signals, with reported fines against Honda ($632,500) and Todd Snyder ($345,178) in September 2025.
  • CCPA regulations effective 1 January 2026 require letting a consumer confirm that their opt-out, including one sent through GPC, has been processed.

Record keeping

CCPA regulations (§7101) require keeping records of consumer requests and your response for at least 24 months: the date and nature of the request, how it was made, the response date, the nature of the response and the basis for any denial.

How to comply with Macaw

  1. Give sale, sharing and advertising their own category

    In Cookie Preferences, put advertising, cross-site tracking and data sharing in a category of their own, such as "marketing", so a visitor can refuse it separately. The Macaw banner starts every optional category off, which is stricter than US law requires and meets opt-in states for sensitive data.

  2. Respect the GPC signal in your code

    Until Macaw handles GPC itself, check the signal before loading anything that sells, shares or targets. Treat a visitor with GPC on as having refused those categories, even if they clicked Accept all.

    const gpc = navigator.globalPrivacyControl === true;
macaw.on('consent.updated', (e) => {
  if (e.data.choices.analytics) loadAnalytics();
  if (e.data.choices.marketing && !gpc) loadAdPixels();
});

  3. Load optional tags only after consent

    Do not set analytics or marketing cookies until the visitor has granted that category. Listen for the consent.updated event and load each tag only when its category is true.

    macaw.on('consent.updated', (e) => {
  if (e.data.choices.analytics) loadAnalytics();
  if (e.data.choices.marketing) loadMarketingPixels();
});

  4. Keep proof of every decision

    Macaw stores each Reject all, Save choices and Accept all on its servers with every category's choice, the exact banner wording shown (as a notice version), the time, the page path and a truncated IP. Records are hash-chained, so a changed record is detected. Find one person under Compliance > Consent Records, or export everything as CSV for an audit.

  5. Keep records for 24 months

    Under Compliance > Consent Records, keep retention at 24 months or more (the default).

  6. Let people change their mind at any time

    Add a persistent "Cookie settings" link to your site footer that reopens the Macaw banner. Visitors can change or withdraw their choice with the same effort it took to give it, and each change is stored as a new record.

    <a href="#" onclick="macaw.triggerCookie(currentUser && currentUser.id); return false;">
  Cookie settings
</a>

What Macaw does not do yet

  • Macaw does not yet detect GPC or record a "GPC applied" decision, and does not show visitors a confirmation that their GPC opt-out was processed. Handle the signal in your code as shown above.
  • Macaw does not switch to opt-out defaults for US visitors; its opt-in banner is stricter than US law requires.

Sources

This guide summarises public regulator guidance and legal commentary to help you configure consent. It is not legal advice. Laws, deadlines and enforcement change; have your counsel confirm what applies to your business.

See Macaw consent management · All regions

More consent guides