US privacy law used to mean one state. In 2026, twenty states have comprehensive privacy laws in effect, enforcement has moved from warnings to seven-figure settlements, and regulators are checking whether websites actually honor a visitor’s opt-out. For a SaaS company, the website is usually where most of the risk sits: ad pixels, analytics, chat widgets and form tools all collect personal data. This guide explains what the rules require from your site and how to set it up once for US and international visitors.
This article is general information, not legal advice. Your privacy counsel should confirm what applies to your business.
The state of US privacy law in 2026
There is still no federal privacy law. Instead, twenty states have comprehensive privacy laws in effect in 2026, with Indiana, Kentucky and Rhode Island taking effect on January 1, 2026. Rhode Island’s thresholds are among the lowest, applying to businesses that handle data on 35,000 residents.
Most of these laws share the same shape. Visitors have the right to know what you collect, to access and delete it, and to opt out of the sale of their data, targeted advertising and profiling. Unlike the EU, they generally do not require opt-in consent before you collect data, except for sensitive data and data about children.
Does CCPA apply to you?
The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that handle California residents’ personal information and meet at least one of these thresholds:
| Threshold | Figure |
|---|---|
| Annual gross revenue | More than $26,625,000, adjusted for inflation |
| Consumers or households | Buys, sells or shares data on 100,000 or more California residents |
| Revenue from data | 50% or more of annual revenue from selling or sharing personal information |
Many early-stage startups fall below these thresholds. That does not mean you can ignore privacy. Enterprise buyers ask about it in security reviews, other states use lower thresholds, and fixing a site later costs more than building it right.
What counts as selling or sharing on a website
This is where SaaS sites get caught. Under CCPA, “sharing” means disclosing personal data for cross-context behavioral advertising, whether or not money changes hands. On a typical marketing site, that includes:
- Meta, LinkedIn, X and Google Ads pixels used for retargeting or conversion tracking
- Analytics with advertising features switched on, such as Google signals
- Session recording or chat tools that send data to vendors who use it for their own purposes
First-party analytics used only to measure your own site, and tools that act strictly as your service providers under a contract, are generally treated differently. The configuration matters as much as the tool.
The website requirements
- An opt-out link. Businesses that sell or share data must offer a “Do Not Sell or Share My Personal Information” link, and a “Limit the Use of My Sensitive Personal Information” link if relevant. A single “Your Privacy Choices” link can cover both.
- Honor Global Privacy Control. GPC is a browser signal that says “opt me out.” Firefox, Brave and DuckDuckGo support it. California, Colorado, Connecticut, New Jersey and Oregon require businesses to treat it as a valid opt-out.
- Show that the signal was honored. Since January 1, 2026, California’s regulations require businesses to display whether they processed a visitor’s opt-out preference signal, for example with a message such as “Opt-Out Request Honored.”
- No dark patterns. Opting out must be as easy as opting in. Regulators fined Ford $375,703 in March 2026 for adding friction to its opt-out process.
- A current privacy policy. It must list the categories of data you collect, why, who receives it and how visitors exercise their rights, and be updated at least every 12 months.
- Stricter rules for minors. Selling or sharing data of consumers under 16 requires opt-in consent.
Enforcement is real
California’s regulators and Attorney General have turned website opt-outs into a priority.
| Company | Year | Amount | Issue |
|---|---|---|---|
| Ford | 2026 | $375,703 | Unnecessary friction in the opt-out process |
| Disney | 2026 | $2.75 million | Opt-outs not applied across devices and accounts |
| Healthline | 2025 | $1.55 million | Targeted advertising without a working opt-out |
| Sephora | 2022 | $1.2 million | Global Privacy Control signals not processed |
Administrative fines run up to $2,663 per violation and $7,988 for intentional violations, and regulators can count violations per affected consumer.
“Most privacy problems on SaaS sites are not policy problems. They are a pixel that fires before anyone gets a choice.”
One setup for US, EU and UK visitors
SaaS sites rarely serve one country. The cleanest approach is a single consent system that satisfies the strictest rules you face and still feels light to US visitors:
- Block non-essential scripts until a choice is made. Analytics, pixels and session recording load only after consent. This meets EU and UK opt-in rules and goes beyond what US law requires.
- Treat a GPC signal as a rejection of selling, sharing and targeted advertising, and say so on screen.
- Give Accept and Reject equal weight, with a Customize option for categories.
- Keep a permanent link such as “Cookie settings” or “Your Privacy Choices” in the footer, so visitors can change their mind.
- Remember the choice for a sensible period, such as six months, then ask again.
- Turn off advertising features you do not use, such as Google signals and ad personalization in GA4.
- Map every tool on the site, what it collects and whether its vendor uses data for its own purposes, and keep that list with your privacy policy.
This is the setup we run on vuradigital.com: nothing loads until a visitor accepts, GPC is honored automatically, and a Cookie settings link stays in the footer.
How to implement it on your platform
- Webflow: add a consent manager through site-wide custom code, and load analytics and pixels through it rather than through separate embeds. Check that any Webflow apps or integrations that add their own tracking respect the same choice.
- WordPress: use a consent plugin that blocks scripts before consent and supports GPC, then audit plugins that add their own tracking.
- Custom builds: load third-party scripts only from a consent callback, read
navigator.globalPrivacyControlon load, and record the choice with a timestamp and policy version.
Whichever platform you use, test the result. Load the site in Firefox or Brave with GPC on, open the network panel and confirm that no ad or analytics requests fire.
Sources
- 20 state privacy laws in effect in 2026, MultiState, February 2026
- California Consumer Privacy Act 2026 guide: thresholds and penalties, Usercentrics
- New CCPA rules require businesses to show opt-out signals were honored, Nelson Mullins
- Global Privacy Control: legal status and enforcement, Wikipedia, March 2026