What are cookie consents and do you really need them on your website?

By: Nicole Kardell

Most of us are accustomed to receiving pop-up notices regarding cookies when we first visit a website.  Some people quickly click the “accept” button and move on. Others review their choices, and opt out of some, if not all, optional cookies.  Why suddenly, have we been offered such choices online, even in the U.S.?  Those in Europe and the U.K. have been accepting and rejecting cookie consents since 2018, when the General Data Protection Regulation went into effect.  But for people in the U.S., cookie consents are still somewhat novel.

Our law firm regularly gets asked by businesses whether cookie consents are necessary for their U.S.-facing platforms.  The underwhelming response is “maybe” or “it depends.”  Since the U.S. does not have a federal privacy law that applies across the states (apart from sector and demographic-specific laws), we have a patchwork of state laws (currently 19 states have laws enacted, some of which are in effect, others which will take effect in 2025/2026).  Those state laws have varying requirements with which you may or may not need to comply depending (largely) on your annual revenues and data collection practices.  You can check out our chart outlining which states have laws and what triggers compliance here.

If it seems like a lot to study the state law patchwork and apply it to your business, you can raise the bar for your data privacy and security practices to meet the most rigorous standards: put into place (with legal guidance) a comprehensive privacy policy, robust data security measures, and minimize your personal data collection and processing [Caveat: This is a high-level summary, but not a blueprint.  Your business practices may require additional measures, including for the handling of sensitive data.].  When you use people’s personal data to serve targeted ads, or share that data with other businesses to serve targeted ads, make sure that people know this and have the opportunity to say “no” up front.

Many businesses have opted to do just this: put together policies and practices to comply, regardless of whether various state laws actually are triggered for their businesses.  Hence the cookie consents that are popping up everywhere you go online.

What do the cookie consents accomplish?: Cookie consents give website visitors the option to reject optional cookies (data trackers that the company otherwise would place on their devices to track their activities on the business’ website and across other websites).  The cookie consents help companies to comply with state laws regarding targeted advertising.  A common theme across U.S. state data privacy laws is to ensure that website visitors have the option to not have their personal data used for the purposes of targeted advertising.  Here is a sample of these laws:

• The California Consumer Privacy Act, as amended by the Consumer Privacy Rights Act, gives California consumers the right to request businesses stop selling or sharing their personal data for cross-context behavioral advertising. See Ca Civ. § 1798.120.
• The Colorado Privacy Act, gives Colorado consumers the right to opt out of the processing or their personal data for the purposes of targeted advertising, the sale of that data, or profiling for significant decision-making. See CRS § 6-1-1306(1)(a).
• The Utah Consumer Privacy Act gives Utah consumers the right to opt out of the processing of personal data for targeted advertising or the sale of that data. See UC § 13-61-201(4).
• The Virginia Consumer Data Protection Act gives consumers the right to opt out of the processing of personal data for targeted advertising, the sale of that data, or profiling for significant decision-making. See 59.1-577(A)(5).

The use of people’s personal data for targeted advertising is not only a focal point for state privacy laws, it is a focal point for regulators: The Colorado Attorney General started to enforce consumer privacy rights regarding the opt out for advertising shortly after the state’s law went into effect.  The California Attorney General announced an “investigative sweep” to go after companies for failing to implement opt out mechanisms for consumers.  And if you have any online presence in the U.K. and Europe, you should be aware that cookie consents are not only necessary, but regularly enforced.  For gaming sector businesses, note that Sky Betting and Gaming was the subject of an action by U.K. regulators for failing to provide “meaningful choice over advertising cookies or making improvements to gain people’s consent.”

The upshot: Do you need get people’s consent to collect their online data for advertising?  Maybe not.  You may be too small to trigger state privacy laws.  But the size and success of your platform may get you to compliance obligations before you know it and developing good data hygiene practices today is smart.  It can keep you out of trouble with regulators, and help you to establish a better relationship with your customers.