veloconsent.com
US plan for Laura

Invite. Follow up.
Tell us what happened.

Every morning at 9:00 Madrid you get an email with 12 US agencies. Goal by Christmas: 8 agency partners.

Every day

About 45 minutes. Ticks clear each morning.

Once, this week

Set up and you're done.

Every week

Ticks clear each Monday.

Messages to copy

Replace the brackets. Stop after day 10.

Day 1 · after they accept

Thanks for connecting, [First name]. Genuine question, since you build on [platform]: when a client asks about US privacy laws or opt outs, who usually handles it, you or the client?

Day 4 · something useful

[First name], this might help your clients in [state]: a plain English page on what state privacy laws ask of a website, veloconsent.com/us-state-privacy-laws. Happy to run a free 15 minute scan of one client site with you, no strings.

Day 10 · last note

Last note from me, [First name]. If Velo is ever useful for your client sites, agencies keep 20% of what every client they refer pays: veloconsent.com/agencies. No problem if the timing is wrong.

The 12 weeks

The daily email switches state for you.

Five rules

  1. Ask, don't claim. Never tell anyone their site breaks the law.
  2. No promises about results or conversions.
  3. Prices only from veloconsent.com/pricing.
  4. Anything commercial goes to Walter.
  5. Velo isn't legal advice.
Why these states?

Each of these states' privacy laws asks the businesses it covers to honor Global Privacy Control, the browser's opt out signal. Many small sites sit under the size thresholds, so always ask, never assume. Checked 27 September 2026.

#StateGPC ruleWho the law coversWhy it's on the list
1CaliforniaRequired by the CCPA regulations. Since 1 January 2026 sites must also show whether they honored the signal$26.6M revenue, or buys, sells or shares data of 100k+ people, or earns half its revenue from selling dataBiggest market. Fines tied to GPC: Sephora $1.2M (2022), Healthline $1.55M and Tractor Supply $1.35M (2025), Disney $2.75M (2026). Every browser must offer an opt out signal from 1 January 2027
2ColoradoRequired since 1 July 2024. GPC is the only signal the attorney general recognizes100k Colorado consumers, or 25k plus revenue from selling data. Nonprofits tooJoined the joint GPC sweep with California and Connecticut in September 2025. Cure period ended 1 January 2025
3ConnecticutRequired since 1 January 202535k consumers, or any sale of data, or any sensitive dataThe attorney general ran a cookie banner sweep in fall 2024 and joined the GPC sweep. Lowest thresholds of the seven
4TexasRequired since 1 January 2025, with conditions (verification, and an exception for businesses that don't process such signals for other states)Any business that isn't a small business by the SBA definition. No revenue thresholdLarge market. The attorney general brought the first lawsuit under a comprehensive state privacy law (Allstate, January 2025)
5New JerseyRequired since 15 July 2025100k consumers, or 25k plus revenue from selling dataDense agency market next to New York. Cure period ended 1 July 2026
6OregonRequired since 1 January 2026100k consumers, or 25k plus over 25% of revenue from selling dataNewest requirement of the seven. Cure period ended 1 January 2026
7MontanaRequired since 1 January 202525k consumers, or 15k plus over 25% of revenue from selling dataThresholds lowered in October 2025 and no cure period. Smallest market, so the fewest list days