For years, US store owners mostly worried about California. That's no longer the full picture. As of 2026, around 20 US states have comprehensive consumer privacy laws in effect, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.
Each law is slightly different, but they share a common core. If your store tracks visitors for advertising, you probably need to make some changes.
Do These Laws Apply to My Store?
Most state laws only apply above certain thresholds. Common ones are:
- Processing personal data of 100,000 or more residents of that state in a year, or
- A smaller number (often 25,000) if you make a big share of revenue from selling data.
California uses a revenue threshold (over $26.6 million in 2026) as well as data-based tests. Texas and Nebraska are broader and apply to most businesses that aren't small businesses under federal definitions.
Many small stores fall below the thresholds. But website visitors count as consumers, so a store with heavy ad traffic can cross 100,000 people in a state faster than expected. And following the rules is good practice anyway, because ad platforms and Shopify increasingly expect it.
What the Laws Have in Common
- Right to access, correct and delete personal data.
- Right to opt out of the "sale" of personal data and of targeted advertising.
- Consent for sensitive data, such as health or precise location.
- A clear privacy policy explaining what you collect and why.
- Data protection assessments for higher-risk processing, like targeted advertising.
For an online store, the most important part is targeted advertising. Sending visitor data to Meta, Google Ads or TikTok for retargeting is usually treated as targeted advertising or a "sale" or "share" of data, so customers must be able to opt out.
Global Privacy Control (GPC)
GPC is a browser signal that tells websites "don't sell or share my data". California, Colorado and several other states require businesses to treat it as a valid opt-out request. If a visitor's browser sends GPC, your store should automatically stop ad tracking for them, without making them click anything.
How This Works on Shopify
Shopify has built-in tools that help:
- Customer Privacy settings let you set regional rules, including an opt-out model for US visitors.
- "Your privacy choices" / "Do not sell or share" link: Shopify can add this to your footer for regions that need it.
- GPC support: Shopify's privacy tools can respect the GPC signal for its own tracking and for apps that use the Customer Privacy API.
- Data requests: Shopify's customer privacy features help you handle access and deletion requests.
As with cookie consent in Europe, the gaps usually come from tracking code that bypasses Shopify's system: pixels pasted into theme files, old tag manager setups, or apps that ignore privacy signals.
A Practical Checklist
- Turn on Shopify's Customer Privacy settings with US regional rules.
- Add a "Your privacy choices" link in the footer.
- Move all tracking into Shopify Customer Events or consent-aware apps.
- Test that GPC actually stops ad pixels from firing.
- Update your privacy policy to cover state privacy rights.
- Have a simple process for handling access and deletion requests within the legal deadline (often 45 days).
Frequently Asked Questions
Do I need a cookie banner for US visitors?
Most US states use an opt-out model, not opt-in. You need a clear way to opt out rather than a consent-first banner, but a banner can be a good way to present the choice.
What if I'm based outside the US?
The laws protect residents of those states, so they can apply to foreign businesses that meet the thresholds.
Is this the same as CCPA?
The California law (CCPA, as amended by CPRA) was the first and is the strictest in some areas. The other states follow a similar but not identical model.
This article is general information, not legal advice.
Want your Shopify store's tracking and privacy setup checked? I audit pixels, fix tracking that bypasses consent and set up privacy controls correctly. Get a free quote.
Need a Shopify store built or improved?
Tell me what you need — I’ll respond within 24 hours with a realistic plan and quote.