Filter by Category

Advertising Cookies – Are They Illegal in Your State Yet?

What Are Advertising Cookies and Why Do They Matter?

If you’ve ever browsed for a new pair of shoes online and then suddenly seen ads for those exact shoes everywhere you go on the internet, you’ve experienced advertising cookies in action. These small pieces of data are stored on your device when you visit websites, and they help companies track your behavior, interests, and browsing habits to serve you targeted advertisements.

While this might seem like a convenient way to discover products you actually want, many people have serious concerns about how their personal data is being collected, stored, and shared — often without their full knowledge or clear consent. That’s where cookie law and privacy law come into play.

How Do Advertising Cookies Actually Work?

When you visit a website, small text files called cookies are placed on your browser. Advertising cookies, sometimes called tracking cookies, are specifically designed to follow your activity across multiple websites. Here’s a simple breakdown of how the process works:

You visit a website that has advertising partners or third-party ad networks.
A cookie is placed on your browser by that third-party network.
As you browse other sites, the same ad network recognizes your cookie and builds a profile of your interests.
Advertisers use that profile to show you ads they believe are relevant to you.
Your data may be sold or shared with other companies without you ever knowing.

This system of data tracking has become the backbone of online advertising. However, growing public concern about digital privacy has pushed lawmakers across the country to take a closer look at how these cookies are being used.

The Rise of Privacy Laws in the United States

Unlike Europe, which introduced a sweeping privacy regulation called the General Data Protection Regulation (GDPR) back in 2018, the United States has taken a slower, more fragmented approach to privacy law. Instead of one national law, individual states have started passing their own privacy legislation — and the rules vary quite a bit depending on where you live.

This patchwork of state laws has created both opportunities and confusion for consumers and businesses alike. Some states offer strong protections that give residents real control over how their data is collected and used. Other states have little to no meaningful regulation in place yet.

States With Strong Cookie and Privacy Laws

Several states have passed comprehensive privacy laws that directly affect how advertising cookies can be used. Here’s a look at some of the most notable examples:

California

California leads the way in the United States when it comes to privacy law. The California Consumer Privacy Act (CCPA), which went into effect in 2020, gave California residents the right to know what personal data is being collected, the right to delete that data, and the right to opt out of the sale of their personal information. It was later strengthened by the California Privacy Rights Act (CPRA) in 2023, which added even more protections and created a dedicated privacy enforcement agency.

Virginia

Virginia’s Consumer Data Protection Act (CDPA) went into effect in January 2023. It gives Virginia residents the right to access, correct, and delete their personal data. It also requires businesses to get consent before processing certain types of sensitive data and allows consumers to opt out of targeted advertising.

Colorado

Colorado passed its Privacy Act in 2021, which came into force in July 2023. Much like Virginia’s law, it gives residents the ability to opt out of targeted advertising and the sale of their personal data. It also puts strong obligations on businesses to be transparent about their data tracking practices.

Connecticut and Utah

Both Connecticut and Utah also passed consumer privacy laws in 2022, with both taking effect in 2023. These laws provide residents with similar rights to opt out of data tracking and targeted advertising, though the specifics of each law differ slightly in terms of which businesses are covered and what exemptions apply.

Texas, Montana, and Others

More states continue to join the privacy law movement. Texas passed the Texas Data Privacy and Security Act, which became effective in 2024. Montana, Iowa, Indiana, Tennessee, and several others have followed suit with their own versions of consumer privacy laws that include protections related to advertising regulation and data tracking.

What Do These Laws Actually Require?

While the details vary from state to state, most of these privacy laws have some things in common when it comes to advertising cookies and data tracking:

Transparency: Businesses must clearly disclose what data they collect and how they use it.
Opt-out rights: Consumers must be given the ability to opt out of the sale of their personal data and targeted advertising.
Data minimization: Companies should only collect the data they actually need for a specific purpose.
Consent requirements: In some states, businesses must get explicit consent before collecting certain categories of sensitive data.
Security obligations: Businesses must take reasonable steps to protect the data they collect.

Are Advertising Cookies Technically Illegal?

Here’s where it’s important to be clear: advertising cookies themselves are not outright illegal in any U.S. state right now. What the laws regulate is how those cookies can be used and what rights consumers have in relation to the data they collect.

In practical terms, this means that a business can still use advertising cookies and data tracking — but they may be required to:

Display a clear cookie consent banner on their website.
Allow users to reject non-essential cookies.
Provide an easy way for users to opt out of having their data sold or used for targeted advertising.
Honor opt-out requests within a specified time frame.

If a business fails to meet these requirements, they can face significant fines and penalties. California’s enforcement agency, for example, has already taken action against companies that were not following the rules set out under the CCPA and CPRA.

What About a National Privacy Law?

There have been several attempts in the U.S. Congress to pass a federal privacy law that would create one unified standard for cookie law and data tracking across all 50 states. The American Data Privacy and Protection Act (ADPPA) gained significant bipartisan support in recent years and came closer than any previous effort to becoming law.

However, as of now, no federal privacy law has been passed. The debate continues, with some lawmakers pushing for a strong national standard that would override state laws, while others want to preserve each state’s ability to set its own rules. Until a federal law is in place, the state-by-state approach will continue to define how advertising regulation works across the country.

How Can Consumers Protect Themselves Right Now?

Regardless of which state you live in, there are practical steps you can take to limit how much data advertising cookies collect about you:

Use your browser’s privacy settings to block third-party cookies. Most modern browsers offer this option in their settings menu.
Install a browser extension designed to block trackers and advertising cookies.
Use a privacy-focused browser like Firefox or Brave, which have built-in tracking protection features.
Read cookie consent banners carefully and choose to reject non-essential cookies when given the option.
Opt out of data sales if you live in a state with privacy laws that give you that right. Many websites now include a “Do Not Sell My Personal Information” link in their footer.
Regularly clear your cookies from your browser to remove stored tracking data.

What Does This Mean for Businesses?

If you run a business that operates online, staying up to date with advertising regulation is more important than ever. Failing to comply with applicable cookie law in states where your customers live can result in costly fines, legal action, and damage to your reputation.

Here are some steps businesses should consider taking:

Conduct a thorough audit of what data you collect and how it is used.
Update your privacy policy to be transparent and easy to understand.
Implement a cookie consent management platform that gives users real choices.
Train your team on privacy compliance requirements.
Monitor changes in state privacy laws on a regular basis, as this area is evolving quickly.

The Bigger Picture: Privacy Is Becoming a Right

The rapid growth of state privacy laws across the United States reflects a broader cultural shift. People are increasingly aware of how their personal information is being collected and used online, and they want more control over it. The days of invisible data tracking without consequences are slowly coming to an end.

Whether you’re a consumer trying to protect your own information or a business trying to stay on the right side of the law, understanding how cookie law and data tracking regulation works is no longer optional. It’s a practical necessity in today’s digital world.

As more states pass privacy laws and federal legislation continues to be debated, the landscape of advertising regulation will keep changing. Staying informed is the best thing anyone — consumer or business — can do to be prepared for what comes next.