Cookie Consent in 2026: The Banner Is the Easy Part
A cookie consent banner used to be a five-minute add-on, a checkbox before launch. In 2026, it's a compliance decision that touches every marketing platform on your site, and getting it wrong is now an expensive way to find that out.
The Patchwork Just Became the Norm
As of July 2026, 20 states enforce comprehensive privacy laws requiring businesses to disclose their data practices and honor consumer opt-outs:
California
Colorado
Connecticut
Delaware
Florida*
Indiana
Iowa
Kentucky
Maryland
Minnesota
Montana
Nebraska
New Hampshire
New Jersey
Oregon
Rhode Island
Tennessee
Texas
Utah
Virginia
Three of those, Indiana, Kentucky, and Rhode Island, joined the list on January 1, 2026. If you've filed this under "that's a GDPR thing" or "only matters if I sell in California," that's out of date. With no federal privacy law in place, this is a nationwide patchwork now, and if your site reaches customers across state lines, one or more of these laws almost certainly applies to you.
* Florida's law only applies to a narrow slice of very large companies, roughly $1 billion in revenue plus other criteria, which is why some trackers, including IAPP's, leave it out of "comprehensive" counts.
The Requirement Most Sites Miss: Browser Signals
California and Colorado already require websites to recognize browser-based opt-out signals like Global Privacy Control (GPC) and treat them as valid, automatically, without a click. Several more states have their own opt-out signal requirements written into their privacy laws, and that list shifts as new laws phase in, so it's worth checking a current tracker rather than relying on any single article's snapshot, including this one. A properly configured consent platform reads and honors these signals automatically. A footer link by itself does not.
Enforcement Has Cookie Banners in Its Sights
In July 2025, California's Attorney General secured a $1.55 million settlement, the largest CCPA settlement to date, against Healthline.com over a consent banner that let readers uncheck a box to stop tracking while trackers kept running behind it anyway. It's the clearest illustration of what regulators are actually checking: whether the banner does what it claims. The same office fined Sephora $1.2 million in 2022 for a similar failure to honor opt-out requests sent through the GPC signal.
California's dedicated privacy regulator, the California Privacy Protection Agency, has been active too. In 2025, it fined American Honda $632,500, the second-highest CCPA fine on record at the time, over a privacy tool that presented opt-out and opt-in choices unevenly, and fined clothing retailer Todd Snyder $345,178 after a misconfigured privacy portal left consumer opt-out requests unprocessed for 40 days. Colorado, Connecticut, and Oregon have since opened their own reviews of consent and opt-out practices.
A Platform Default Is Only a Starting Point
The consent banners built into platforms like BigCommerce and Shopify are useful starting points, but out of the box they generally don't account for state-by-state opt-out rights, "Do Not Sell or Share" obligations, or GPC handling, which happen to be exactly what regulators are enforcing. Real compliance means identifying every marketing pixel, tag, and third-party app on your site (analytics, ad platforms, retargeting, chat, reviews) and connecting each one to your consent platform so it fires only when permitted. Then testing every connection against every consent choice, browser signal, and applicable state rule to confirm scripts actually block and fire as intended.
Done Right, You Keep Your Data
A one-size-fits-all banner that applies strict opt-in rules to every visitor blocks your marketing pixels by default, even in states where you're legally permitted to track. Since most visitors never actively click accept, that setup quietly surrenders conversion and retargeting data you had every right to collect. Geo-aware configuration applies opt-in only where the law requires it, and the opt-out model where that's the standard. Paired with Google Consent Mode and analytics tags configured to respect it, you retain modeled conversion data even from visitors who decline.
What "Done" Actually Looks Like
- Reviewing your existing tracking implementation
- Configuring the consent platform for your specific state and signal requirements
- Updating tags across every marketing platform, from Google Analytics and Google Ads to Meta, Klaviyo, and LinkedIn
- Implementing Google Consent Mode
- Testing across browsers and devices
- Validating that tracking only fires after the appropriate consent is granted
- Documenting every configuration so your compliance posture stays transparent over time
Bottom Line
Most state laws don't mandate a banner by name. They mandate outcomes: clear disclosure, a working opt-out, and honored browser signals. A properly configured, monitored, and documented consent setup is the clearest way to deliver all three while protecting the marketing data your business runs on.
If you're not sure where your site actually stands, we're happy to take a look. Contact MoJo Active to review your current setup.
This post is general information, not legal advice. Confirm your specific obligations with qualified privacy counsel.
