How does a CCPA cookie banner work in CookieConsentHQ?
CookieConsentHQ offers a US opt-out model in which non-essential cookies load by default and visitors can opt out. The model also supports Global Privacy Control handling according to the configured regional rule.
This behavior differs from the platform's opt-in model, which blocks non-essential cookies and known trackers until acceptance. Selecting the appropriate model is a decision about your site's data practices and applicable requirements.
The California Consumer Privacy Act (CCPA), as the California Privacy Protection Agency explains, gives covered consumers rights to opt out of the sale or sharing of personal information. In this context, sharing includes certain disclosures for cross-context behavioral advertising.
A website's cookie categories and its legal obligations are related but not identical. Switching off marketing cookies does not establish that every activity involving the sale or sharing of personal information has stopped.
CookieConsentHQ provides banner controls for visitor choices. The website operator remains responsible for determining how those controls relate to its actual data collection and disclosures.
What happens when a visitor sends Global Privacy Control?
When a regional rule is configured to honor Global Privacy Control (GPC), CookieConsentHQ automatically switches off the marketing category. The resulting action is recorded in the consent log as gpc_auto.
GPC is a browser-level preference signal that lets a visitor communicate an opt-out choice without making a separate request through every website's controls.
The California Privacy Protection Agency's FAQ states that businesses must honor opt-out preference signals that meet certain requirements, such as Global Privacy Control, as a valid request to opt out of sale or sharing. The agency also described GPC enforcement activity in its September 2025 announcement.
CookieConsentHQ includes GPC support on every plan, but the relevant region rule determines whether the product honors the signal for that location.
The automatic marketing-category change and the gpc_auto record are specific, observable behaviors. They should be assessed alongside the site's other technologies and data practices.
For the jurisdictions and their different rules, use the state-by-state GPC guide. This page concentrates on CookieConsentHQ's controls.
Can I set different consent rules for US states?
Yes, CookieConsentHQ supports custom rules by US state from Starter upward. Each custom region can select opt-in, opt-out or notice and determine whether GPC is honored.
The visitor's location is supplied by Cloudflare's edge network at request time. CookieConsentHQ uses that information to select the configured regional rule.
Free includes the three presets: the mixed global configuration, opt-in everywhere and US opt-out everywhere. Creating your own state-specific rules requires Starter or a higher plan.
The geo-targeting feature explains these settings, including country and Canadian province targeting. Custom regional rules let you express different configurations for different states without requiring a separate banner installation for each location.
You should not assume that every US state imposes the same requirements. The rules vary, and the relevance of any particular opt-out requirement depends on the law and the website's activities.
Use the GPC guide for the state-level legal discussion rather than treating a single US-wide preset as an analysis of each state.
How can I check whether a GPC choice was recorded?
The consent log records an automatically applied GPC action as gpc_auto. It also stores whether GPC was sent, together with the recorded region, country and applicable state or province.
Each record contains a consent ID, UTC timestamp, action, categories and banner configuration version. These fields provide context for inspecting a particular recorded choice.
A website can obtain the current consent ID using CCHQ.getConsent().id, for example when adding it to a privacy request form. The site owner can look up that ID in the dashboard.
Records can also be exported as CSV. Retention is one year on Free, three years on Starter and five years on Growth and higher plans.
A record of the GPC action confirms what CookieConsentHQ stored for that choice. It does not establish whether every external service used by the website has stopped the activities covered by an opt-out request.
See the consent log for the fields, retention periods and lookup process.
Which plan should I choose for US state targeting?
Free includes the US opt-out preset and GPC support. Starter begins at $8 per month and adds custom rules by US state, along with geo-targeting by country and Canadian province.
Starter includes 150,000 monthly pageviews, weekly scheduled scans and three-year consent log retention. Growth begins at $18 per month with 750,000 pageviews, daily scans and five-year retention.
Every plan keeps the banner running after its pageview allowance is exceeded, without overage fees. On Free, new consent records pause after 25,000 monthly pageviews until the next month.
Review the allowances on the pricing page before choosing a plan for your sites.
CookieConsentHQ's controls do not determine whether a particular business is subject to the CCPA or another state privacy law. This page reflects official information checked on October 20, 2026 and is not legal advice.