| GDPR (EU) |
Any business processing the personal data of EU, UK, EEA (European Economic Area) residents, regardless of company size or revenue. |
Opt-in |
Yes — banner blocks non-essential cookies until the user chooses. Must offer “Accept All,” “Reject All,” and access to category controls, all with equal visual prominence. After consent, a floating button remains available so users can change their preferences at any time. |
Enforced by Data Protection Authorities (DPAs) in EU member states. Tiered fines: up to €10M or 2% of global turnover for procedural violations; up to €20M or 4% for substantive violations. |
| CCPA & CPRA (CA) |
Gross annual revenue of $25M (adjusted to $26.625M for inflation) OR 100K+ CA consumers OR 50%+ revenue from selling/sharing |
Opt-out |
No banner required. A floating button on every page, paired with a “Do Not Sell or Share My Personal Information” link in the footer, is sufficient. Global Privacy Control (GPC) signals must be honored automatically. |
Enforced by the California Attorney General and the California Privacy Protection Agency (CPPA). $2,500 per violation / $7,500 per intentional violation. Private right of action for data breaches: $100–$750 per consumer. |
| CIPA (CA) |
Any website accessible to California visitors. No revenue or volume thresholds — applies universally. |
Opt-In |
Mandatory (per recent court interpretations). Must block tracking until consent is given, provide “accept” and “decline” options of equal prominence, and allow users to withdraw consent. |
Private right of action allowing consumers to sue businesses directly. Statutory damages of up to $5,000 per violation. |
| VCDPA (VA) |
Businesses processing personal data of 100,000+ Virginia consumers in a calendar year, OR processing data of 25,000+ consumers AND deriving more than 50% of gross revenue from the sale of personal data. |
Opt-out |
No banner required. A floating button with access to preferences is sufficient. Opt-in consent required for sensitive personal data categories. |
Enforced by the Virginia Attorney General. Up to $7,500 per violation, with a 30-day cure period. No private right of action. |
| CPA (CO) |
Businesses processing personal data of 100,000+ Colorado consumers in a calendar year, OR processing data of 25,000+ consumers AND deriving any revenue or discount from the sale of personal data. |
Opt-out |
No banner required. A floating button with access to preferences is sufficient. Universal opt-out signals (GPC) must be recognized. |
Enforced by the Colorado Attorney General and district attorneys. $2,000–$20,000 per violation, up to $50,000 for violations involving minors. |
16 other US state laws
|
Thresholds vary by state. As of 2026, 19 US states have comprehensive privacy laws in effect. |
Opt-out |
Not required. Most follow Virginia’s model. 12 states now require GPC signal recognition. |
Enforced by state attorneys general. Typical penalties range $2,500–$7,500 per violation. Most states have cure periods of 30–60 days. |
