Every day
About 45 minutes. Ticks clear each morning.
Once, this week
Set up and you're done.
Every week
Ticks clear each Monday.
Messages to copy
Replace the brackets. Stop after day 10.
Thanks for connecting, [First name]. Genuine question, since you build on [platform]: when a client asks about US privacy laws or opt outs, who usually handles it, you or the client?
[First name], this might help your clients in [state]: a plain English page on what state privacy laws ask of a website, veloconsent.com/us-state-privacy-laws. Happy to run a free 15 minute scan of one client site with you, no strings.
Last note from me, [First name]. If Velo is ever useful for your client sites, agencies keep 20% of what every client they refer pays: veloconsent.com/agencies. No problem if the timing is wrong.
The 12 weeks
The daily email switches state for you.
- California 28 Sep to 25 Oct
- Colorado, Texas, Connecticut 26 Oct to 22 Nov
- New Jersey, Oregon, Montana 23 Nov to 20 Dec
- Break, no emails 21 Dec to 3 Jan
Five rules
- Ask, don't claim. Never tell anyone their site breaks the law.
- No promises about results or conversions.
- Prices only from veloconsent.com/pricing.
- Anything commercial goes to Walter.
- Velo isn't legal advice.
Why these states?
Each of these states' privacy laws asks the businesses it covers to honor Global Privacy Control, the browser's opt out signal. Many small sites sit under the size thresholds, so always ask, never assume. Checked 27 September 2026.
| # | State | GPC rule | Who the law covers | Why it's on the list |
|---|---|---|---|---|
| 1 | California | Required by the CCPA regulations. Since 1 January 2026 sites must also show whether they honored the signal | $26.6M revenue, or buys, sells or shares data of 100k+ people, or earns half its revenue from selling data | Biggest market. Fines tied to GPC: Sephora $1.2M (2022), Healthline $1.55M and Tractor Supply $1.35M (2025), Disney $2.75M (2026). Every browser must offer an opt out signal from 1 January 2027 |
| 2 | Colorado | Required since 1 July 2024. GPC is the only signal the attorney general recognizes | 100k Colorado consumers, or 25k plus revenue from selling data. Nonprofits too | Joined the joint GPC sweep with California and Connecticut in September 2025. Cure period ended 1 January 2025 |
| 3 | Connecticut | Required since 1 January 2025 | 35k consumers, or any sale of data, or any sensitive data | The attorney general ran a cookie banner sweep in fall 2024 and joined the GPC sweep. Lowest thresholds of the seven |
| 4 | Texas | Required since 1 January 2025, with conditions (verification, and an exception for businesses that don't process such signals for other states) | Any business that isn't a small business by the SBA definition. No revenue threshold | Large market. The attorney general brought the first lawsuit under a comprehensive state privacy law (Allstate, January 2025) |
| 5 | New Jersey | Required since 15 July 2025 | 100k consumers, or 25k plus revenue from selling data | Dense agency market next to New York. Cure period ended 1 July 2026 |
| 6 | Oregon | Required since 1 January 2026 | 100k consumers, or 25k plus over 25% of revenue from selling data | Newest requirement of the seven. Cure period ended 1 January 2026 |
| 7 | Montana | Required since 1 January 2025 | 25k consumers, or 15k plus over 25% of revenue from selling data | Thresholds lowered in October 2025 and no cure period. Smallest market, so the fewest list days |
- CCPA regulations, effective 1 January 2026 (§7025, opt out preference signals)
- Sephora settlement, California AG, August 2022
- Healthline settlement, California AG, July 2025
- Tractor Supply order, CPPA, September 2025
- Disney settlement, California AG, February 2026
- California AB 566, the Opt Me Out Act
- Joint GPC sweep by California, Colorado and Connecticut, September 2025
- Colorado AG, universal opt out
- Connecticut AG, Data Privacy Act
- Texas Data Privacy and Security Act (HB 4) and the Allstate lawsuit
- New Jersey Data Privacy Act, AG announcement
- Oregon DOJ, privacy law FAQs
- Montana Code §30-14-2809
- IAPP, US state privacy laws in force in 2026