Get ready for visitors from the United States · Docs

Written for Cookie Rocks 2.9.14, checked on 5 November 2026. The current version is 2.11.2: some details may have changed.

This guide is for sites with visitors in the United States. Several US states ask sites to honour the Global Privacy Control signal, to show a “Do Not Sell or Share” link, and to keep a record of refusals.

You need: Cookie Rocks Audit (free) to see what your states ask and what your banner does. Cookie Rocks Pro to honour the signal, show the link and keep the refusals.

The Obligations page of Cookie Rocks Audit, with the points of what the law asks of the site — Cookie Rocks 2.11.2 · Click to enlarge

See what your states ask

Open Cookie Rocks, then Obligations. Under Who are your visitors?, tick United States in the Americas block for every state, or tick some states under United States: only some states. Then click Show what the law asks of my site.
Read the point United States: the Global Privacy Control signal. It names the states of your visitors that require the signal, and those where it is “Required soon”.
When one of these states requires the signal and your site uses marketing cookies, the point United States: a “Do Not Sell or Share” link appears too. It concerns businesses that sell or share personal data for advertising, above a size set by each law.
Open Consent. Under Your cookie banner, the row Global Privacy Control says whether your current banner Honoured or Ignored the signal. If it is ignored, look for this option in the settings of your cookie plugin.

If you see… a red Alert about Global Privacy Control at the top of the Overview: a state of your visitors requires the signal and your banner ignores it. When you address California, the check of your home page also says when it finds no “Do Not Sell or Share My Personal Information” link (or “Your Privacy Choices”) there.

Set it up with Cookie Rocks Pro

The Do Not Sell or Share view of the Cookie Rocks banner, with the one-click opt-out of sale and sharing — Cookie Rocks 2.11.2 · Click to enlarge

With Cookie Rocks Pro

Open Consent. Under Global Privacy Control, choose Honour the GPC signal, then click Save Changes. The Alert of the Overview offers the same fix in one click. When a browser sends the signal, marketing stays off, even if the visitor clicks Accept all. For a signed-in visitor, the refusal follows their account to their other browsers. A ring then lights up around the cookie button, with the label “Opt-out request honored”, as California requires: see The ring around the cookie button.
Add the link to your footer: put the shortcode [cookie_rocks_link type="do-not-sell"] in a Shortcode block of your footer. It writes “Do Not Sell or Share My Personal Information”, in the language of the page.
Open a page in a private window and click the link. A view titled “Do Not Sell or Share My Personal Information” opens, with a short text, a link How we handle this request to your cookie policy, and two buttons: All cookie choices and Opt out of sale and sharing.
Click Opt out of sale and sharing. Marketing cookies turn off, the other choices stay as they were, and the choice is recorded in the register of proofs. The button then reads Opted out of sale and sharing, and the cookie button shows a ring and the words “Opt-out request honored”.
If your business is large enough to be covered, tick Also record the refusals sent by browsers, without a click under Global Privacy Control. California asks this above about 26.6 million dollars of yearly revenue, or the data of 100,000 people; Colorado, above the data of 100,000 people. Each browser that sends the signal leaves one refusal in the register, kept 24 months. It adds a few bytes to each page.
Open Proof of consent. Under the settings, Opt-out records gives how long refusals and opt-out requests are kept for your states.

The “Do Not Sell or Share” view exists only when your Obligations profile includes a US state. With rules by country on, every visitor located in the United States gets its link, even on a site that does not target the United States, and Accept all and Reject all look the same in the states that have a privacy law. When the analysis finds no advertising cookie or tag, the view says so, and its button still applies to any added later. The cookie policy written by Cookie Rocks says how the site treats the Global Privacy Control signal.

Tip. A refusal has its own duration in some states. It lasts at least 12 months in California: the banner does not ask again before that. In Colorado, a refusal is renewed at each visit. With Cookie Rocks Pro, the banner applies these durations by itself. To show visitors from some states a banner that lets cookies run until they refuse, see the Rules by country screen.

Using Google Analytics? Check its data sharing settings.

More detail: Consent, Proof of consent and Shortcodes. In short: Legal questions.

Next step: Prove consent if an authority asks

See also: Cookie Rocks for websites with US visitors, what changes for this kind of site.

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.