US privacy laws
Do you need a cookie banner for Google Ads in the US? What the CCPA actually asks of an advertiser
Owners who see European cookie banners everywhere often assume a US site needs one too before Google Ads or GA4 can run. California's privacy law works differently: it is mostly an opt-out law, and it only applies to businesses above certain thresholds. This guide sets out who the CCPA covers, what it asks of a business that advertises, and what Google offers to help, quoting the official pages. It is not legal advice: if you are near the thresholds, ask a lawyer.
Messages this guide covers: Do Not Sell or Share My Personal Information
, Global Privacy Control
, Restricted data processing
, restricted_data_processing
, Consent mode
.
Ask your AI to read this guide for you.
Does the CCPA apply to your business?
The California Privacy Protection Agency's FAQ says the CCPA applies to for-profit businesses that do business in California and meet any of these thresholds:
- "Have a gross annual revenue of $26.625 million or more (effective January 1, 2025) for the preceding calendar year"
- "Buy, sell, or share the personal information of 100,000 or more California residents or households"
- "Derive 50% or more of their annual revenue from selling or sharing California residents' personal information"
The California Attorney General's CCPA page still shows the original $25 million figure. The agency's FAQ has the adjusted one. The Attorney General's page also says the CCPA "generally does not apply to nonprofit organizations or government agencies".
For most small businesses running Google Ads, none of the three applies. If you are close to one of them, the rest of this guide is the part to read with your lawyer.
Why advertising counts: "sale" and "sharing"
The Attorney General's page explains that "sharing refers specifically to sharing for cross-context behavioral advertising, which is the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's online activity across numerous websites."
In Google Ads terms, that is remarketing and audience lists built from what people did on your site and elsewhere. Showing a Search ad to someone who typed a query is a different thing. So the question for a business covered by the CCPA is not whether it uses Google Ads, but whether it uses data from your site to target people across other sites.
Opt-out, not a cookie banner
The CCPA gives California residents a "right to opt-out of sale or sharing", including "via a user-enabled global privacy control". It does not require opt-in consent before cookies are set. The opt-in requirement on the Attorney General's page is for minors: businesses "can only sell the personal information of a child that they know to be under the age of 16 if they get affirmative authorization ('opt-in')".
A covered business that sells or shares personal information must offer:
- A "Do Not Sell or Share My Personal Information" link. The Attorney General describes "a clear and conspicuous" link on the website, and says businesses "cannot require you to create an account" to use it. The same link must appear in the privacy policy.
- Respect for Global Privacy Control. Consumers "can also submit an opt-out request via a user-enabled global privacy control, like the GPC". A browser with GPC switched on is an opt-out.
- A 12-month wait before asking again. "Businesses must wait at least 12 months before asking you to opt back in to the sale or sharing of your personal information."
This is enforced. In August 2022 the Attorney General announced a $1.2 million settlement with Sephora, which had allowed third-party tracking on its site and, according to the Attorney General, failed to process opt-out requests "via user-enabled global privacy controls".
What Google offers: restricted data processing
Google's restricted data processing page describes a mode in which "Google restricts the way it uses certain unique identifiers", acting as your service provider under its US state privacy terms. What changes for the advertiser:
- Remarketing stops for those users. "Certain features will be unavailable, including adding users to remarketing lists."
- Measurement keeps working. "Even when restricted data processing is enabled, features, such as conversion tracking and campaign measurement, will continue to function as normal."
- Two ways to switch it on in Google Ads. A "restricted_data_processing" parameter in the Google tag for particular users, such as people who clicked your opt-out link, or a checkbox in the remarketing tag settings for all users in applicable US states.
- GPC is handled for you in some states. Google says it "will turn off ads targeting and activate restrictive data processing (RDP) if we receive a GPC in these U.S. States."
- A California exception. "As of July 1, 2023, restricted data processing is not available in California where the advertiser engages in cross-context behavioral advertising, including Customer Match."
Google's US state privacy page adds that "Advertisers should work with their legal advisors to determine whether and how they should comply with applicable US state privacy laws."
Consent mode is a separate tool. Google's consent mode page says it "lets you communicate your users' cookie or app identifier consent status to Google" and "doesn't provide a consent banner or widget". In advanced mode Google defaults to a consented state unless a choice is made, "though there may be regional behavioral differences for specific areas like the EEA, Switzerland, and the UK". If your ads also reach Europe or the UK, those visitors need a consent banner, and the UK rules are covered on ppcconsultancy.uk.
What to do today
- Check the three thresholds. Revenue, the number of California residents or households whose data you buy, sell or share, and the share of revenue from selling or sharing. If none applies, the CCPA does not apply, and you do not need a California opt-out link for it.
- List what your tags do. Conversion tracking and Search ads are one thing. Remarketing, Customer Match and audience lists are the "sharing" the law is about.
- If you are covered: add the "Do Not Sell or Share My Personal Information" link to the site and the privacy policy, make it work without an account, and make sure your consent tool honors GPC.
- Connect the opt-out to Google. Set the restricted_data_processing parameter for users who opt out, or enable it for all users in applicable states. Conversion tracking keeps working either way.
- If you advertise to Europe or the UK, run a consent banner for those visitors, separately from the US setup.
- Have the setup checked once. A conversion tracking setup covers the tags, consent signals and restricted data processing together.
A wider look at how privacy changes affect paid media in 2026 is on diwizi.com.
Official sources used in this guide
- https://cppa.ca.gov/faq.html
- https://oag.ca.gov/privacy/ccpa
- https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement
- https://support.google.com/google-ads/answer/9614122?hl=en
- https://business.safety.google/usaprivacy/
- https://support.google.com/google-ads/answer/10000067?hl=en
More guides for when something breaks
Questions people ask before hiring
Do US websites need a cookie banner for Google Ads?
Not under the CCPA in the way European sites do. The CCPA is an opt-out law: businesses it covers must offer a Do Not Sell or Share My Personal Information link and honor Global Privacy Control. Opt-in is required for selling the data of minors under 16. Other states have their own laws, so check with a lawyer if you are close to the thresholds.
Does the CCPA apply to small businesses?
Only if they meet one of three thresholds: gross annual revenue of $26.625 million or more (as adjusted from January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of revenue from selling or sharing it.
Is Google Ads remarketing a sale or sharing of data?
Under the CCPA, sharing means sharing for cross-context behavioral advertising, which targets ads based on activity across websites. Remarketing and audience lists built from site visitors fall into that description. Search ads shown to people who typed a query do not depend on it.
Does conversion tracking stop if I enable restricted data processing?
No. Google says conversion tracking and campaign measurement continue to function as normal. What stops is adding those users to remarketing lists.
What is Global Privacy Control?
A browser setting that signals the user's choice to opt out. The California Attorney General treats it as a valid opt-out request, and in 2022 settled with Sephora for $1.2 million partly for not processing it.
Related services
Tell me about the account
Spend band, site and what is not working. You get a straight answer on whether I can help, what I would do first and a price range. No proposal deck, no sales follow-up sequence.