COMPLIANCE / CARBIDE INSIGHTS

Twenty states have a privacy law most dealership websites never check for.

BY CARBIDE DIGITALPUBLISHED September 13, 2026REVIEWED September 13, 20266 min read410 WORDS

A state privacy law can require a dealership website to honor a signal that a cookie consent banner never touches. A separate, largely invisible obligation sits underneath the banner in a growing number of states: honoring an automated signal a visitor's own browser sends, without the visitor clicking anything.

ANSWER IN BRIEF

State Privacy Law & Opt-Out Signals for Dealership Websites

Twenty states had enacted comprehensive consumer privacy laws as of early 2026, and twelve of them require businesses to recognize an automated browser-level opt-out signal, most commonly Global Privacy Control (GPC), as a valid request to stop the sale or sharing of a visitor's personal information, without requiring the visitor to click anything on the site itself. California, Colorado and Connecticut have announced a coordinated multi-state investigative sweep specifically targeting businesses that fail to honor these signals. Many websites, including most built on standard dealer platform templates, do not currently detect or respond to this signal at all, which means a dealership can have a fully compliant-looking cookie banner and still be out of compliance with this specific, separate requirement in any of the twelve states that mandate it.

Reviewed September 13, 2026 by Carbide Digital

KEY TAKEAWAYS

The short version.

20 states had comprehensive privacy laws in force as of early 2026; 12 of them require honoring an automated browser opt-out signal (most commonly Global Privacy Control), not just a clicked cookie-banner choice.
The signal is sent automatically by the visitor's browser or a browser extension, before the visitor interacts with the site at all, which is why most sites built on standard templates never detect it.
California, Colorado and Connecticut have announced a coordinated enforcement sweep specifically targeting businesses that fail to honor these signals.
A cookie banner that looks compliant is a separate mechanism from honoring this automated signal; a site can have one without the other.

#What the signal is, and why most sites miss it

GPC works quietly, in the background. Global Privacy Control is a browser-level setting, built into some browsers directly and available as an extension for others, that transmits a machine-readable signal to every website a visitor loads: this visitor does not want their personal information sold or shared, with no click required on the site itself. The signal is simply present in the visitor's request, the same way a browser reports its language preference.

A website has to be built for this, and detecting the signal does not happen by default. A standard dealer platform template, built primarily around a click-through cookie banner, does not automatically check for it. The two mechanisms, a banner requiring a click and an automated signal requiring none, are separate systems, and a site can build out one fully while never touching the other.

#Which states require this, and what enforcement looks like

Twelve states require this now. As of January 2026, twelve states require recognition of a universal opt-out mechanism or opt-out preference signal, generally satisfied by Global Privacy Control: California, Colorado, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, Oregon and Texas, among the twenty states with comprehensive privacy laws overall.

California, Colorado and Connecticut have announced a joint investigative sweep specifically targeting businesses that do not honor GPC signals, which signals a coordinated multi-state enforcement posture rather than isolated, one-off actions.

TABLE

States requiring recognition of an automated opt-out signal, as of early 2026

State privacy law changes; verify current status before relying on this for a specific compliance decision.

Requirement	States (as commonly cited)
Comprehensive privacy law in force	20 states, including California, Colorado, Connecticut, Virginia, Texas and others
Requires honoring an automated opt-out signal (e.g. GPC)	California, Colorado, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, Oregon, Texas
Announced coordinated GPC enforcement sweep	California, Colorado, Connecticut

Compiled 2026-09-13 from public state-privacy-law trackers current as of early 2026; state law changes, verify current status with counsel.

This sits alongside the broader tracking and disclosure questions covered on the dealership website hub, including privacy demand letters and chat widget exposure.

This is one of Carbide’s insights on dealership marketing and SEO.

DIRECT ANSWERS

Questions about this topic.

Is a cookie consent banner enough by itself?

Not always. Not in the states that require honoring an automated opt-out signal. A banner requiring a click and an automated browser-level signal are two separate mechanisms; a site can have a compliant-looking banner and still fail to detect or act on the signal.

How do we know if our site currently detects Global Privacy Control?

Ask your developer directly. This is a technical check your website provider or developer can confirm: whether the site reads the GPC signal from incoming requests and applies an opt-out automatically when it is present.

Does this apply to us if we are not in California?

Yes, it can. It applies based on the visitor's state, not the dealership's location, and 12 states currently require it. A dealership advertising or serving customers across state lines has more states' requirements potentially in play, not fewer.

What counts as 'selling or sharing' data under these laws?

Broader than you would think. The definitions vary by state and generally extend beyond a literal sale to include sharing data with ad-tech and analytics vendors for targeted advertising. Confirm your platform's specific definitions with counsel.

Is this the same as the CCPA?

No, and considerably broader. The CCPA (California) is one of the 20 state laws and one of the 12 requiring signal recognition, but it is not the only one, and each state's law has its own specific requirements and enforcement mechanism.

What does the announced enforcement sweep mean for us?

More scrutiny, not less. It means at least three states are coordinating active investigation of GPC compliance specifically, rather than relying only on complaint-driven enforcement, which raises the practical likelihood of a site being checked regardless of whether a specific complaint was filed against it.

Does honoring this state privacy signal mean we stop advertising to that visitor entirely?

No. It stops the specific practice of selling or sharing that visitor's data for cross-context targeted advertising. A site can still advertise generally, run its own on-site promotions, and use data it collected for its own first-party purposes.

Is this state privacy signal the same as the old 'Do Not Track' browser setting?

No, and the difference matters. Do Not Track was a voluntary browser signal with no legal force behind it, largely ignored by websites. Global Privacy Control carries actual legal weight in the states that require recognizing it.

Does our dealership website's cookie consent platform handle this automatically?

Not always. Some consent management platforms detect and act on the signal by default; others require the site to configure that behavior explicitly. Confirming which is true for your specific platform is worth doing rather than assuming.

PRIMARY SOURCES

References used for this analysis.

Continue the analysis.

COMPLIANCE