The structural difference
The EU model is opt-in: you may not set non-essential trackers until the visitor agrees. The US model, where state privacy laws apply, is generally notice and opt-out: you must tell people what you collect and give them a way to say no — particularly to the sale or sharing of personal information and to targeted advertising.
That difference is why a US site usually does not need the interstitial that blocks the page before anything loads, and why the compliance artefact tends to be a link in the footer rather than a modal.
What US state laws typically require
Requirements vary by state and change as new laws take effect, but the recurring elements are:
- A privacy notice describing categories of personal information collected, purposes, and third parties involved
- A mechanism to opt out of sale or sharing of personal information, and of targeted advertising — commonly the footer link phrased as "Do Not Sell or Share My Personal Information"
- Rights to access, delete and correct personal information
- Recognition of universal opt-out signals such as Global Privacy Control in several states
- Additional care around sensitive categories of data
Thresholds matter: many of these laws apply only above a certain revenue or volume of consumers' data, so a small site may fall outside their scope entirely. Check the applicable thresholds for the states where your users are.
Why so many US sites show an EU banner anyway
Three practical reasons.
They have EU visitors. If any meaningful share of traffic is European, EU rules are in scope regardless of where the company is based, and running one banner for everyone is simpler than geo-targeting two experiences.
Their vendor ships one. Consent management platforms default to the strictest configuration.
Risk aversion. Showing a banner nobody needed has a cost measured in conversion rate; not showing one that was needed has a cost measured in regulatory attention. Legal teams choose accordingly.
The cost of a banner you did not need
It is not zero. A consent interstitial reduces conversion, adds a render-blocking script, and removes from your analytics every visitor who declines — which biases the data you use to make decisions.
If you have no EU traffic, no sale or sharing of personal information, and analytics that stores nothing on the device, an EU-style banner is pure cost.
A pragmatic approach
1. Audit what you actually run. Advertising and social pixels are the components that trigger "sale or sharing" analysis under several state laws — analytics alone often does not.
2. Check whether the state laws apply to you at all, given their thresholds.
3. Look at where your visitors are. If EU traffic is material, plan for the EU rules.
4. Publish a clear privacy notice and the opt-out mechanism where required.
5. Honour Global Privacy Control — several states require it and it costs little to implement.
6. Consider removing trackers instead of managing them. Fewer moving parts means less to comply with in every jurisdiction at once.
This is general information rather than legal advice; US requirements vary by state and by the nature of your business, and a qualified attorney should confirm your specific position.