State Privacy Laws for Affiliate Marketers
Around twenty states have comprehensive privacy laws by 2026, regulating the tracking and 'sale' of data that affiliate cookies perform. The obligations and a single baseline.
The fastest-changing area of US affiliate compliance is state data privacy. As of 2026, roughly twenty states have comprehensive consumer privacy laws in effect, with around two dozen enacted in total and more phasing in. For affiliates, the crucial point is that these laws regulate the tracking and monetization of personal data — which is what affiliate cookies and pixels do.
Why affiliates are in scope
Affiliate tracking, retargeting pixels, and analytics collect personal data and frequently involve what these laws call the “sale” or “sharing” of personal data — terms defined broadly enough to capture the exchange of data with advertising and affiliate partners, even without money changing hands for the data itself. That brings affiliate sites within scope once they meet a law’s applicability thresholds.
Common obligations across the state laws
- A privacy notice describing the data you collect, the purposes, and consumer rights.
- A right to opt out of the sale or sharing of personal data and of targeted advertising — often via a “Do Not Sell or Share My Personal Information” mechanism.
- Recognition of universal opt-out signals such as the Global Privacy Control (GPC) in a growing number of states.
- Rights to access, correct, and delete personal data.
- Limits on processing sensitive data and, in several states, added protections for minors.
The current landscape
| State(s) | Law | Status | Key affiliate-relevant duty |
|---|---|---|---|
| California | CCPA / CPRA | In effect | Opt-out of sale/sharing; GPC honored |
| Virginia | VCDPA | In effect | Opt-out of targeted ads & sale |
| Colorado | CPA | In effect | Universal opt-out (GPC) required |
| Connecticut | CTDPA | In effect | Universal opt-out required |
| Utah | UCPA | In effect | Opt-out of targeted ads & sale |
| Texas | TDPSA | In effect | Opt-out; broad applicability |
| Oregon | OCPA | In effect | Opt-out; data-broker limits |
| Montana | MCDPA | In effect | Universal opt-out required |
| Florida | FDBR | In effect | Applies to very large firms |
| Delaware, New Jersey, New Hampshire, Nebraska, Iowa, Tennessee, Minnesota, Maryland | Various | In effect / phasing in | Opt-out of sale & targeted ads |
| Indiana, Kentucky, Rhode Island | Various | Effective 2026 | Opt-out of sale & targeted ads |
The GPC signal is becoming mandatory
Several states — including California, Colorado, and Connecticut — require businesses to honor the Global Privacy Control, a browser signal that automatically expresses a consumer’s opt-out. If your site sets advertising or affiliate trackers, you should detect and respect GPC.
A practical baseline
Rather than tracking each state individually, adopt a privacy baseline that satisfies the strictest: publish a clear privacy notice, provide a “Do Not Sell or Share” opt-out, honor the GPC signal, and gate advertising and affiliate trackers through a consent or preference mechanism. This mirrors the approach you already need for EU and UK visitors under GDPR and the ePrivacy rules, so a single well-built consent and preference system can cover both.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.