Cookie consent banners for US websites: when you need one and how the tools compare (2026)

Do you need a cookie consent banner in the US?

Most small US business sites do not need an EU-style “accept before we track you” banner. What US state laws ask for is different: a way for people to opt out of the sale or sharing of their data and of targeted advertising, and respect for the opt-out signal their browser sends. This is general information, not legal advice. If your business is near a state law’s size thresholds, ask a lawyer.

Three questions decide what you need:

1. What runs on your site? A cookie that keeps a cart working is not the issue. Ad pixels (Meta, Google Ads, TikTok) and tracking cookies used for targeted ads are what state laws treat as “selling” or “sharing” data.
2. Which state laws reach you? Each state privacy law applies only above its own thresholds. Colorado’s law, for example, applies to businesses processing data of 100,000 or more Colorado residents a year, or earning revenue from selling data of 25,000 or more, according to the Colorado Attorney General.
3. Do you market to Europe or the UK? Their rules generally require consent before non-essential cookies are set. That is where the classic opt-in banner comes from.

Our US website laws guide covers privacy policies, the California rules and the rest of the basics. This page is about the banner itself and the tools that make one.

GPC: the browser signal your banner has to hear

Global Privacy Control (GPC) is a setting that tells every site a person visits “do not sell or share my data.” The GPC project calls it “a proposed specification” and says Brave and DuckDuckGo support it natively (DuckDuckGo has it on by default), while Firefox offers it in settings. It became a W3C Privacy Working Group work item in November 2024.

The signal matters because several states make it binding:

• California’s attorney general says a user-enabled GPC signal “must be honored by covered businesses as a valid consumer request” to opt out of sale or sharing, per its CCPA page.
• Colorado has required controllers to honor universal opt-out signals since July 1, 2024, and GPC was the first one it recognized.
• California’s privacy agency lists 12 states where businesses had to honor opt-out signals in 2026 (CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX), with Louisiana added from January 2027 and Vermont from January 2028, in its August 6, 2026 board material.
• From January 1, 2027, California’s Opt Me Out Act requires web browsers to include a setting that sends an opt-out signal. More visitors will be sending GPC.

Our 2027 website trends guide lists the other state laws that start in 2027. The practical takeaway: if you run ad pixels, pick a consent tool that reads GPC and turns those pixels off for that visitor.

What a fair banner looks like

California’s privacy agency has written about this directly. Its Enforcement Advisory No. 2024-02 (September 4, 2024) says the more private choice must not be longer or harder to pick than the less private one. A banner with “Accept All” and “Decline All” side by side is its example of a fair, symmetrical choice. It also warns that “agreement obtained through use of dark patterns does not constitute consent,” and tells businesses to check the interfaces their consent tool supplies.

In practice that means:

• Give “Decline” the same size and weight as “Accept.”
• Don’t hide the opt-out behind a “Settings” link while “Accept” is one click.
• Use plain words, not “Got it” when you mean “I agree to ad tracking.”
• Link your privacy policy from the banner.

Cookie consent tools compared

These are the four tools most small sites end up choosing between. Prices are from each vendor’s own pricing page.

CookieYes

CookieYes works on any site through its web app, and its WordPress plugin has more than 1 million active installs on WordPress.org. According to its plan page, Basic is $100 a year per domain ($10 billed monthly) for 100,000 pageviews a month, Pro is $250 a year ($25 billed monthly) for 300,000, and Ultimate is $550 a year ($55 billed monthly) with no pageview cap. Extra pageviews on Basic and Pro cost $0.30 per 1,000.

The pricing page lists GPC support on Pro and Ultimate only. Google Consent Mode v2 and a US state laws opt-out template are on every plan, including Free. Paid plans have a 14-day trial.

Right for: builder sites and WordPress sites that want one tool with a clear monthly pageview limit.

Complianz

Complianz is a WordPress plugin only. The free version on WordPress.org includes a cookie banner, a cookie scan of up to 50 posts and script blocking, and has more than 1 million active installs. Respecting GPC and Do Not Track, records of consent and separate banners for several regions at once are listed as Premium features.

Premium is billed yearly, per the pricing page: Personal $59 (1 site), Professional $179 (5 sites) and Agency $399 (25 sites, with the multisite plugin). If you stop paying, the plugin keeps working, but you can’t change its settings or documents and updates stop.

Right for: WordPress sites that want everything inside the dashboard and a flat yearly price.

Cookiebot

Cookiebot, from Usercentrics, prices by how many subpages your site has. Its US pricing page shows Premium Lite at $8 a month for one domain with up to 50 subpages, then $16 a month per domain for 350 subpages (on accounts with four or more domains), $34 (3,500), $56 (7,000) and $96 (more than 7,000). The US page lists monthly prices only, and its euro footnotes (Premium Small at EUR 15) don’t match its dollar table, so confirm at checkout. “Global Privacy Control (GPC signal)” is listed among the features all Premium plans include. There is a free plan for one domain up to 50 subpages and a 14-day Premium trial with no card.

Right for: small brochure sites with few pages, and sites that also need EU consent.

Termly

Termly pairs a consent banner with policy generators. Its pricing page shows Starter at $14 and Pro+ at $20 “per website/month,” next to a toggle that says annual billing saves 25%. The page doesn’t make clear which billing period those figures are, so check the total at checkout. The free plan covers one policy and 10,000 banner views a month. Termly’s FAQ says it covers the CCPA, CalOPPA “and 16 other state-level U.S. data privacy laws.”

Termly’s help center says its banner honors GPC once you turn on “Do not sell or share my information” and check “Respect GPC signal.” The article doesn’t say which plans include that setting.

Right for: owners who also want a privacy policy and terms written in the same place.

What the builders include for free

If you are on a website builder, start with what’s already in your dashboard.

Shopify. Shopify’s help center says the data sharing opt-out page is meant for regions that don’t require opt-in consent, “such as in the US,” and that “When the Global Privacy Control (GPC) header is present, it activates opting out of data sale or sharing.” You must publish a privacy policy before turning on the banner. Shopify also says automated privacy settings “aren’t a substitute for legal advice.”

Wix. Wix’s help article says the older Wix Cookie Banner is no longer available for new sites. New banners come from Usercentrics, and “The basic version of the Usercentrics cookie banner is free.” Custom text, translations and design changes need a paid Usercentrics plan. Wix also says it “cannot guarantee” the banner blocks cookies from every third-party app or piece of custom code.

Squarespace. Google’s Analytics Help walks through the Squarespace steps: turn on the banner under Cookies & Visitor Data and pick the Opt In and Out style, which blocks Analytics cookies until a visitor accepts. Squarespace’s own cookie page says the banner restricts only some third-party services and recommends a specialist consent tool for third-party tracking.

On self-hosted WordPress there is no built-in banner, so you add a plugin. We build on WordPress every week, and the setup is the same everywhere: install the plugin, run its scan, check which scripts it found, then test in a private window with GPC turned on.

What it costs over 3 years

Using the same baseline as the rest of this site, a WordPress site on Bluehost Starter costs $432.60 over 3 years ($143.64 hosting, $36.96 domain, $252 for one Google Workspace inbox). Here is what each consent option adds.

Termly Starter would add $504 over 3 years at $14 a month; check whether that is the rate your billing period gets. On Shopify, Wix and Squarespace the built-in banner adds nothing to the plan price, though Wix’s paid Usercentrics features cost extra.

A cheaper route exists: if the only tracking you run is analytics, a cookieless tool can remove the need for a banner for analytics on some sites. Our Google Analytics alternatives guide compares them, and our Google Analytics setup guide covers consent mode if you keep GA4.

How to set one up without breaking your site

1. List what loads. Write down every script: analytics, ad pixels, chat widgets, embedded video, booking tools.
2. Update your privacy policy first. Shopify requires it before the banner, and Google’s Analytics terms require one anyway.
3. Pick a banner style. For US visitors, an opt-out notice with a “Do Not Sell or Share” link. For EU and UK visitors, opt-in with equal “Accept” and “Decline” buttons.
4. Turn on GPC support if you run ad pixels.
5. Run the scan and put each cookie in the right category.
6. Test. Open a private window in Firefox with GPC on, or in Brave, and confirm ad pixels don’t fire. Then click “Decline” in a normal window and check again.
7. Re-scan after changes. A new plugin or embed can add cookies the banner doesn’t know about.

What to do next

• Read the US website laws guide for privacy policy basics.
• See which state rules start in 2027 in our trends guide.
• Learn what the CCPA and CPRA cover, and how Europe’s GDPR differs.
• Running a CMS like WordPress? Pair the banner with a cookieless analytics tool to keep the banner short.