If your website runs Google Analytics, a Facebook or Google Ads pixel, a chat widget or call tracking, it’s collecting visitor data through cookies and similar tools. More and more laws now say you have to tell visitors about it and give them a real choice. A footer note saying “we use cookies” isn’t enough anymore.

Here’s what changed, what the laws say in plain English, and what a compliant WordPress or WooCommerce site looks like.

First, the basics: cookies, privacy policies and cookie policies

Cookies are small files a website saves in a visitor’s browser. Some are necessary, for example to keep someone logged in or to hold items in a WooCommerce cart. Others track behavior for analytics or follow visitors around the web with ads.

They usually fall into three groups:

• Necessary: the site doesn’t work without them
• Analytics: they measure how people use your site
• Marketing: they power ads, retargeting and personalization

Two documents explain this to visitors:

• A Privacy Policy covers what personal data you collect, why you collect it, who you share it with, and how visitors can access, delete or opt out of it.
• A Cookie Policy covers which cookies and tracking tools your site uses and what each one does.

The laws expect both documents to be accurate and your site to actually do what they say.

Is there a U.S. cookie law?

There’s no single federal cookie law. Instead there’s a growing set of rules.

Federal

• FTC Act: the Federal Trade Commission can act against businesses whose privacy policy says one thing while the site does another. It has gone after companies that shared health-related browsing data through ad pixels.
• COPPA: strict consent rules apply if your site collects data from children under 13.
• HIPAA and health data: healthcare providers need to be careful with tracking pixels on appointment and treatment pages. A cookie banner doesn’t make it okay to share health-related activity with ad platforms.

State

About 20 states now have comprehensive privacy laws in effect, and more start in 2027. These include:

• California (CCPA/CPRA), the strictest and most enforced
• Colorado, Connecticut, Virginia and Utah
• Texas, Florida (Florida Digital Bill of Rights), Montana, Iowa, Nebraska, Delaware and others

Most of these laws give visitors the right to opt out of having their data “sold” or “shared” for targeted advertising. Many also require sites to honor browser privacy signals such as Global Privacy Control (GPC), which tells a site “don’t track me” automatically.

California also has the California Invasion of Privacy Act (CIPA). Plaintiffs’ lawyers have used it to file lawsuits over chat widgets, session recording and tracking pixels that load without consent. Many of these suits target small and mid-sized businesses, not just big tech companies.

Doesn’t this only apply to big companies? Not always. California’s law applies if a business meets any one of three tests: a revenue threshold, handling data from a large number of California residents, or earning a large share of revenue from selling or sharing data. Other states set different thresholds. Even if a state privacy law doesn’t apply to you, the FTC rules and lawsuit risk still do. Most of your visitors also expect a cookie choice now.

The ad platforms are enforcing it too

You don’t need a lawsuit to feel this. Google and Microsoft Advertising now expect consent signals from your site. Microsoft requires advertisers to send consent through its UET Consent Mode for visitors from Europe, the UK and Switzerland. Google has similar Consent Mode requirements. If your site doesn’t send these signals properly, conversion tracking and remarketing audiences can suffer. That means wasted ad spend and reports you can’t trust.

Google’s own short explainer shows how Consent Mode works:

Opt-in vs. opt-out: which one do you need?

This is the most important decision:

• Opt-in: tracking waits until the visitor clicks “Accept.” Required for European visitors and the safest choice overall.
• Opt-out: tracking can start right away and stops when the visitor says no. This is how most U.S. state laws work. You still need a working “opt out” option that actually turns the tracking off.

If you get visitors from several regions, a good setup can show each region the right banner and rules.

What a compliant WordPress or WooCommerce site actually looks like

Installing a cookie banner plugin isn’t the same as being compliant. We often see sites with a nice-looking banner where tracking still fires before anyone clicks anything. A proper setup includes:

1. A tracking audit. We find everything on the site that collects data: Google Analytics, Site Kit, Google Tag Manager, Meta pixels, Jetpack Stats, HubSpot, chat widgets, call tracking and embedded videos. We check your home page, contact and booking pages, and WooCommerce checkout.
2. Clean-up. We remove duplicate or unused trackers. It’s common to find the same Google tag installed three times through a plugin, the theme and Tag Manager.
3. A clear banner with Accept, Reject and Manage preferences buttons, plus a way for visitors to change their mind later.
4. Real blocking. Analytics and marketing scripts must wait for consent where required, including scripts loaded through Google Tag Manager. Many banner plugins miss these.
5. Consent Mode for Google and Microsoft so your ad tracking keeps working within the rules.
6. An updated Cookie Policy and Privacy Policy that list the tools your site actually uses.
7. Testing in a fresh browser. We check what happens before a visitor clicks, after Reject, after Accept, and after they change their mind. We also confirm your analytics still report correctly.

Frequently asked questions

Does my small business website really need a cookie banner?

Not every law applies to every business, since state privacy laws have their own revenue and data thresholds. But FTC rules, website-tracking lawsuits and ad platform requirements apply no matter your size. If your site runs Google Analytics, Meta Pixel, Google Ads or similar tools, a working consent setup is the safest move.

Is a cookie banner enough to be compliant?

No. The banner has to actually block trackers until the visitor agrees (or let them opt out where that’s allowed). A banner that shows up while Google Analytics and ad pixels load anyway gives you a false sense of security. Your privacy policy and cookie policy also need to match what the site really does.

Do U.S. websites need opt-in consent like Europe?

Most U.S. state laws use an opt-out model: you can load trackers, but visitors must be able to say no, and many states require you to honor Global Privacy Control signals. If you have visitors from the EU, UK or Canada, you generally need opt-in consent, meaning nothing non-essential loads until they click accept.

Will cookie compliance hurt my Google Analytics or ad tracking?

Done right, the impact is small. Google Consent Mode lets Google Analytics and Google Ads keep sending anonymous signals and model conversions when visitors decline cookies. Without it, Google limits features like remarketing and conversion measurement for traffic from regions that require consent.

What is Global Privacy Control (GPC)?

GPC is a browser setting that automatically tells websites “don’t sell or share my data.” Several states, including California and Colorado, require businesses to treat it as a valid opt-out request. Your consent setup should detect it and turn off advertising trackers for that visitor.

Does WooCommerce add cookies that need consent?

WooCommerce itself uses essential cookies for the cart, checkout and logins, and those don’t need consent. The issue is usually the add-ons: analytics, Meta Pixel, TikTok, Pinterest, Klaviyo, live chat, reviews widgets and Jetpack features. Those are the ones that must be controlled by your consent banner.

Can I just install a free cookie plugin myself?

You can, but most DIY setups miss something: trackers hard-coded in the theme, scripts loaded through Google Tag Manager, or plugins that set cookies before consent. The plugin is the easy part. Auditing what loads, categorizing it correctly and testing it in a clean browser is where most of the work is.

How long does it take to make my site cookie compliant?

For most WordPress and WooCommerce sites, britecode can audit, configure and test cookie compliance within a few business days, depending on how many tracking tools and integrations the site uses.

The bottom line

Cookie compliance has moved past the EU. U.S. state laws, FTC enforcement, lawsuits and ad platform rules all point the same way: visitors should know what’s tracking them and be able to say no. On WordPress and WooCommerce sites, the risk usually doesn’t come from a missing banner. It comes from a banner that doesn’t actually block anything.

britecode now offers cookie compliance setup for WordPress and WooCommerce sites. We audit your trackers, configure consent the right way for your audience, update your policies, and test everything so your analytics and ads keep working.

This article is for general information and isn’t legal advice. Privacy laws change often. Talk to your attorney about the specific requirements for your business.