Do I need a cookie banner in the US? What California's CCPA and the GDPR for EU visitors each ask of a small site

Do I need a cookie banner in the US: the short answer

In the US, the official California pages ask a business that sells or shares personal information for an opt-out link or opt-out signal handling, and they do not name a cookie banner as the method. Visitors from the EU are different: consent comes before non-essential cookies. Whether this covers your own site is a lawyer's question.

Who California's CCPA covers

The Attorney General lists three tests for a for-profit business that does business in California, and meeting any one brings the CCPA in: revenue, the number of California residents or households whose data it buys, sells or shares, and deriving 50% or more of annual revenue from selling their personal information. The sources state the amounts differently.

The Attorney General's page says revenue over $25 million and 100,000 California residents or households. The CCPA statute says $25,000,000 "as adjusted", and the Privacy Protection Agency posts $26,625,000 effective January 1, 2025. Whether your business meets any of the three tests is a question for a lawyer.

What California asks of a site that sells or shares data

The statute asks such a business for a homepage link titled "Do Not Sell or Share My Personal Information" (Civil Code 1798.135(a)(1)), or lets it honor an opt-out preference signal instead (1798.135(b)(1)). The Attorney General says a signal must be honored as a valid request to stop the sale or sharing of personal information, and the regulations say a business that does not sell or share is not required to honor it.

California's CCPA regulations say a cookie banner "is not by itself an acceptable method" for opt-out requests. The official sources describe notices, a link, signals and symmetry in choice rather than a banner by name, while vendor pages present banners as the way to deliver them.

Colorado, Virginia and other states

Colorado's Attorney General says controllers must accept opt-out requests through universal opt-out mechanisms from July 1, 2024, and lists processing the personal data of more than 100,000 individuals in a calendar year among its coverage tests. Virginia's Code section 59.1-578(D) asks for clear disclosure of the processing it covers and of how a consumer may opt out. For any other state, a lawyer is the source.

EU and UK visitors to a US site

The GDPR's Article 3(2) reaches a controller outside the EU when its processing relates to offering goods or services to people in the EU, paid or not.

For cookies, the ePrivacy Directive's Article 5(3), as the EDPB quotes it, allows storing or reading information on a visitor's device only on consent or necessity for specific purposes. The EDPB adds that scrolling is not consent. The ICO's guidance, updated April 29, 2026, requires prior consent in the UK unless an exception applies.

What a banner tool adds

CookieYes puts an opt-in GDPR template (no non-essential cookies until the visitor agrees) and an opt-out US State Laws template on all four plans, the Free plan (one domain) included, and adds Global Privacy Control (GPC), a browser signal that tells a site not to sell or share a visitor's data, from Pro.

As read on October 31, 2026, Basic is $10 a month per domain, billed monthly, for 100,000 pageviews a month, and Pro, which adds GPC, is $25 a month per domain, billed monthly, for 300,000.

This page is informational only and is not legal advice. CookieYes is a technology platform that assists with compliance, each site owner stays responsible for their own compliance, and a qualified lawyer can say what your site needs.

Compare tools in best cookie consent banner. The California detail is in CCPA cookie banner requirements; Analytics is in do I need a cookie banner for Google Analytics.