The twelve states
| State | Statute | Signal duty from | The signal opts out of | Display | Source |
|---|---|---|---|---|---|
| California | California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (Prop 24) Cal. Civ. Code 1798.135(b)(1) and (e); duty made operative by 11 CCR 7025(b) |
The sale and the sharing of personal information (sharing means cross-context behavioural advertising). | Yes | cppa.ca.gov | |
| Colorado | Colorado Privacy Act (SB21-190) C.R.S. 6-1-1306(1)(a)(IV)(B) |
Targeted advertising and the sale of personal data. | No | content.leg.colorado.gov | |
| Connecticut | Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. 42-515 et seq. Conn. Gen. Stat. 42-520(e)(1)(A)(ii) |
Targeted advertising and the sale of personal data. | No | portal.ct.gov | |
| Montana | Montana Consumer Data Privacy Act (MCDPA) MCA 30-14-2809(3)(b) |
Targeted advertising and the sale of personal data. | No | mca.legmt.gov | |
| Nebraska | Nebraska Data Privacy Act (LB1074, 2024) Neb. Rev. Stat. 87-1111(5) |
The sale of personal data and targeted advertising, through an authorized agent set by a browser setting or a global device setting. | No | nebraskalegislature.gov | |
| New Hampshire | New Hampshire Data Privacy Act (NHDPA), RSA 507-H RSA 507-H:6, V(b) (as cited by NH DOJ) |
Targeted advertising and the sale of personal data. | No | doj.nh.gov | |
| Texas | Texas Data Privacy and Security Act (TDPSA, HB 4, 88th Leg.) Tex. Bus. & Com. Code 541.055(e) |
The sale of personal data and targeted advertising, through an authorized agent set by a browser setting or a global device setting. | No | capitol.texas.gov | |
| New Jersey | New Jersey Data Privacy Act (P.L.2023, c.266) N.J.S.A. 56:8-166.11(b)(1) (P.L.2023, c.266, sec. 8.b.(1)) |
Targeted advertising and the sale of personal data. | No | pub.njleg.state.nj.us | |
| Minnesota | Minnesota Consumer Data Privacy Act (MCDPA), Minn. Stat. 325M.10-325M.21 Minn. Stat. 325M.14, subd. 3(a) |
Targeted advertising and the sale of personal data. | No | revisor.mn.gov | |
| Maryland | Maryland Online Data Privacy Act of 2024 (MODPA, SB 541 / Ch. 455) Md. Code Ann., Com. Law 14-4707(f)(3)(ii); see also 14-4706(a)(2) (agent via browser setting or global device setting) |
Targeted advertising and the sale of personal data. | No | mgaleg.maryland.gov | |
| Delaware | Delaware Personal Data Privacy Act (DPDPA), 6 Del. C. ch. 12D 6 Del. C. 12D-106(e)(1)a.2. (version effective until Jan. 1, 2027; same text in the version effective Jan. 1, 2027) |
Targeted advertising and the sale of personal data. | No | delcode.delaware.gov | |
| Oregon | Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589 ORS 646A.578(5)(c) |
Targeted advertising and the sale of personal data. | No | oregonlegislature.gov |
Only California requires the display
From 1 January 2026, section 7025(c)(6) of the California regulations reads: “A business must display whether it has processed the consumer’s opt-out preference signal as a valid request to opt-out of sale/sharing on its website.” Until that day the word was “may”. The free run looks for that status line on your page, in the visit that sent the signal. The regulations, cppa.ca.gov
Every browser, from 1 January 2027
AB 566, the California Opt Me Out Act (Chapter 465, Statutes of 2025), adds section 1798.136 to the Civil Code: from 1 January 2027 a business may not develop or maintain a browser that lacks a setting to send the signal. The share of your visitors who send it rises that day. The statute, cppa.ca.gov
Three rows your counsel should read twice
Maryland’s statute is written as a choice: a controller “may utilize” a link or the signal (Com. Law 14-4707(f)(3)). We list Maryland because the same act requires a controller to honour an authorized agent that a browser setting designates (14-4706). Nebraska and Texas reach the signal the same way, through an agent designated by “an Internet browser setting or extension, or a global setting on an electronic device”. Counsel may read any of the three differently.
Where each row comes from
Each row cites the state’s own legislature, attorney general or privacy agency. Three legislature pages refused a script on 9 October 2026: California’s sits behind a bot challenge, Connecticut’s serves an incomplete certificate chain, and New Hampshire’s dropped every connection. Those rows cite the agency page that quotes the same section, and sources.json gives the legislature’s address too. Every source answered 200 and carried the cited text when this site was built; sources.json holds the address, the status, the retrieval date and the quoted sentence, and the table as data is statutes.json. The table is a reading aid. The statute’s own text governs, and so does your counsel.