Why the US Looks Different From the EU

In the EU, one regulation sets the baseline. In the United States there is no comprehensive federal privacy law covering general website tracking, so a growing number of individual states have passed their own. California was first, and many others have followed with laws that look similar but are not identical.

For a publisher with a national audience, the practical question is not “which one law applies?” but “what is the common set of behaviors that works across all of them?”

Opt-Out Versus Opt-In: The Core Difference

Most EU-style thinking starts from opt-in: no tracking until the user agrees. Most US state laws start from opt-out: you may process ordinary personal data, but you must tell people what you do and let them stop certain activities.

• Targeted advertising — users generally have a right to opt out.
• Sale or sharing of personal data — users generally have a right to opt out.
• Profiling — many laws give an opt-out for profiling used in significant decisions.
• Sensitive data — most of these laws require opt-in consent before processing it, so this is where the model flips.

Always check the exact wording for the states where you have real traffic, because the definitions of “sensitive data” and “sale” differ.

What the Laws Have in Common

Despite the differences, the same building blocks appear again and again:

1. A clear, accessible privacy notice describing categories of data, purposes, and recipients.
2. A visible way to opt out of targeted advertising and sale or sharing, such as a link in the footer.
3. Honoring opt-out preference signals in states that require it, for example Global Privacy Control.
4. A process for handling consumer requests such as access, deletion, and correction.
5. Contracts with vendors that process data on your behalf.

Opt-Out Signals Are Becoming Mandatory

Several states require businesses to treat a browser-based universal opt-out signal as a valid opt-out request. In practice this means that if a visitor’s browser sends the Global Privacy Control signal, your site should apply the opt-out automatically, without asking the visitor to click anything else.

The technical consequence is simple: your consent logic must read the signal before loading advertising and analytics tags, and your tag configuration must have a state that represents “opted out.”

Thresholds and Applicability

Many state laws apply only above certain thresholds, such as the number of residents whose data you process or the share of revenue from selling data. The thresholds vary and change over time, so do not assume a small publisher is automatically out of scope. Ask a lawyer to confirm which laws apply to your business.

Passing the Choice Down the Ad Chain

For advertising publishers, collecting a user’s choice is only half the job. The choice must reach your ad partners. The IAB’s Global Privacy Platform (GPP) was built for this: it carries a US national section and state-specific sections in a single signal so that ad tech vendors can read the user’s status. If your stack still relies on older single-state signals, plan a move to a unified approach as more states appear.

A Practical Operating Model

1. List the states where you receive meaningful traffic.
2. Pick the strictest common behavior and apply it broadly if you prefer simplicity, or localize by state if you need to preserve revenue.
3. Put a persistent opt-out entry point on every page.
4. Test that the opt-out and the browser signal actually stop the relevant tags.
5. Keep records of the choices users made.
6. Review the list of applicable laws on a regular schedule, since new ones keep arriving.

Where FlexyConsent Fits

FlexyConsent supports IAB GPP v1.1 with the US National section and 16 US state laws, so the user’s opt-out choice can be passed to your ad partners in one standard signal. The banner is available in 57 languages, which helps for Spanish-speaking and other multilingual US audiences. This is a tool for collecting and transmitting choices; what your business must do under each law is a matter for your own legal advice.

Key Takeaways

• US state laws are mostly opt-out, with opt-in for sensitive data.
• The common core is notice, a visible opt-out, honoring opt-out signals, and consumer request handling.
• Read opt-out signals before tags fire, not after.
• Use a unified signal such as GPP to pass the choice to ad partners.
• Check applicability and thresholds with a lawyer, and review them regularly.