Are There Cookie Laws in the Us?

The analysis of existing regulations demonstrates that the United States does not have a federal law specifically regulating the use of cookies. However, state-level privacy laws, notably the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (CDPA), address cookie usage as it relates to the processing of personal information.

CCPA establishes that cookies, when used to collect consumer data, are considered personal information (Cal. Civ. Code § 1798.140). Businesses subject to CCPA are required to disclose their use of cookies and the purposes for which data is collected via cookies (Cal. Civ. Code § 1798.100). However, opt-in consent for cookies is not mandated by CCPA for general usage. Notably, when cookies are deployed for targeted advertising and cross-context behavioral advertising, these activities may be classified as a “sale” of personal information under CCPA (Cal. Civ. Code § 1798.140(t)), triggering the obligation for businesses to provide an opt-out mechanism for consumers ("Do Not Sell My Personal Information").

The CDPA in Virginia similarly considers data processed via cookies as personal data when used for targeted advertising, sale, or profiling (Va. Code Ann. § 59.1-571). Under CDPA, consumers possess explicit rights to opt-out of the processing of their personal data for these purposes, implicating third-party and advertising cookies in particular. The operationalization of these rights requires businesses to implement mechanisms allowing consumers to exercise their opt-out rights effectively.

Key findings include:

• There is no overarching federal cookie law in the US.
• Both CCPA and CDPA treat data collected by cookies as personal information when used for specific purposes.
• CCPA mandates disclosure of cookie usage and requires an opt-out if cookies are used for targeted advertising or deemed a “sale.”
• CDPA grants consumers the right to opt-out of processing personal data for targeted advertising, sale, or profiling—explicitly impacting cookie practices.

Overall, while there is no federal cookie law, state-level statutes such as CCPA and CDPA impose targeted requirements on businesses regarding cookie usage, particularly in connection with personal information and targeted advertising practices. The regulatory approach is fragmented and largely reactive to specific uses of cookies rather than imposing blanket requirements as seen in other jurisdictions (e.g., GDPR in the EU).