Analytics and US privacy laws: what they ask of your site
Published 27 October 2026 · 10 min read
The United States has no single federal privacy law. Analytics on a website is shaped instead by state laws, led by California's, by a federal rule for sites aimed at children, and by the federal ban on deception, which covers what you say about privacy. This article covers what each asks of analytics, whatever tool you use.
This is not legal advice. Each law has its own scope and exceptions, and they change often; for a decision about your site, ask someone qualified.
The short answer
- State laws are built mostly around opting out. People can tell you to stop selling their data or using it for advertising across other sites. Measuring your own site is neither in itself, but its data is usually still personal information.
- Global Privacy Control counts as an opt-out in California, Colorado and Connecticut.
- A site directed to children under 13 falls under COPPA, which allows a persistent identifier without parental consent only for narrow internal purposes.
- Your privacy statements must be true of every tool on your site.
California: the CCPA, as amended by the CPRA
Who it applies to
The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue over $25 million, adjusted for inflation (currently $26,625,000); buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50 percent or more of annual revenue from selling or sharing it (Civil Code §1798.140(d); CalPrivacy: monetary thresholds). A "consumer" is a California resident.
Analytics data is usually personal information
The definition is wide: information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked" to a consumer or household. Its examples include an IP address, a "unique personal identifier", and "information regarding a consumer's interaction with an internet website application, or advertisement" (§1798.140(v)). A unique identifier includes cookies, device identifiers and a "unique pseudonym" (§1798.140(aj)).
Two things fall outside it: deidentified information, which comes with conditions of its own, and "aggregate consumer information", about a group "from which individual consumer identities have been removed" (§1798.140(b), (m), (v)(3)). Reports of totals may be aggregate; raw events tied to an identifier are a different matter.
"Selling" and "sharing"
To sell is to make personal information available to a third party "for monetary or other valuable consideration". To share is to make it available to a third party for "cross-context behavioral advertising", which means targeting ads using a person's activity across other businesses' sites, apps or services, "whether or not for monetary or other valuable consideration" (§1798.140(ad), (ah), (k)).
A service provider is not a third party. It processes personal information on your behalf under a written contract that forbids it from selling or sharing the data or using it for anything else (§1798.140(ag), (ai)). So an analytics tool working only for you, under such a contract, is not usually a sale. One that uses your visitors' data for itself, or for advertising across other sites, may be.
Opt-outs, the link and Global Privacy Control
A business that sells or shares personal information must offer a "Do Not Sell or Share My Personal Information" link, or honour an opt-out preference signal instead (§1798.135(a), (b), in CalPrivacy's text of the Act).
The regulations say that a business receiving a valid signal "shall treat the opt-out preference signal as a valid request to opt-out of sale/sharing … for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles". It adds: "This is not required for a business that does not sell or share personal information." The business must also show on its website whether it has processed the signal (CCPA Regulations §7025). The Attorney General names Global Privacy Control as such a signal and says it "must be honored by covered businesses as a valid consumer request" (California Attorney General: CCPA).
Notice at collection
Whether or not you sell anything, a covered business must tell people, at or before collection, the categories of personal information it collects, why, whether it is sold or shared, and how long it is kept (§1798.100(a), in the Act). Analytics belongs in that notice.
The pattern in other states
A growing number of states have comprehensive privacy laws, with different thresholds and dates. Three show the common pattern: a controller decides why data is processed, a processor works under its instructions and a contract, and people can opt out of targeted advertising, the sale of their data and certain profiling. This is not a full list.
- Colorado applies to controllers that process the data of more than 100,000 residents in a year, or of 25,000 or more while earning revenue or discounts from selling it. Controllers have had to accept universal opt-out mechanisms since 1 July 2024, and Global Privacy Control is on the Attorney General's list of recognised mechanisms (Colorado AG: Colorado Privacy Act; Colorado AG: universal opt-out mechanism).
- Connecticut has required businesses under its law to honour signals that "opt out of targeted advertising and the sale of their personal data" since 1 January 2025, and names Global Privacy Control as one (Connecticut AG, 30 December 2024).
- Texas has no count of consumers: small businesses, as the federal Small Business Administration defines them, are generally exempt instead. Its Attorney General notes that personal data includes pseudonymous data "when the data is used in conjunction with additional information that reasonably links the data to an identified or identifiable individual", and that deidentified data is not personal data (Texas AG: Texas Data Privacy and Security Act).
Children: COPPA
The Children's Online Privacy Protection Rule covers operators of commercial websites and online services, apps included, that are directed to children under 13, and general-audience operators with actual knowledge that they collect from a child (FTC: COPPA FAQ). Its personal information includes "a persistent identifier that can be used to recognize a user over time and across different websites or online services", such as a cookie, an IP address or a device identifier (16 CFR §312.2).
Parental consent is not needed where an operator collects a persistent identifier and nothing else, solely for "support for the internal operations" of the service, a list that begins "maintain or analyze the functioning of the website or online service". That identifier cannot be used "to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose" (§312.2, §312.5(c)(7)). The amended Rule, in force since 23 June 2025 with most obligations from 22 April 2026, also asks the operator's notice to name those internal operations and how it keeps the identifier to them (§312.4(d)(3); Federal Register, 22 April 2025).
Whether your analytics fits that exception is a question for advice. The FTC's FAQ adds that "you are responsible for the collection of personal information from your users, no matter who is doing the collection".
Honesty: Section 5 of the FTC Act
Section 5 declares "unfair or deceptive acts or practices in or affecting commerce" unlawful (15 U.S.C. §45). The FTC finds deception where there is "a representation, omission or practice that is likely to mislead the consumer acting reasonably in the circumstances, to the consumer's detriment" (FTC Policy Statement on Deception, 1983).
For analytics, that makes your privacy policy and store listing promises. The FTC's technologists have written that "false or misleading representations with regards to privacy and security by companies—whether explicitly or impliedly, by inclusion or by omission—may be a violation of the law" (FTC, 1 February 2024), and that "companies should not act or claim as if hashing personal information renders it anonymized" (FTC, 24 July 2024). If your policy says you do not track people, every script on the page has to agree.
What to check for your own site
- Which laws reach you? Your revenue, how many residents of each state you measure, and whether your audience includes children.
- Does any tool sell or share, using the data for itself or for advertising elsewhere?
- Is there a service-provider or processor contract with each tool that handles the data?
- Is Global Privacy Control honoured, and shown where that is required?
- Do your notice and privacy policy match what is collected, why and for how long?
Websites, extensions and apps
These laws are written about businesses and consumers, not websites, so an extension or app meets the same definitions. What differs is the mechanics: a store's disclosure rules apply too, and not every browser shows Global Privacy Control to an extension. For the stores, see the Chrome Web Store privacy practices tab and passing Firefox add-on review with analytics.
Common questions
Do I need a cookie banner in the US?
These state laws are built mainly around opting out, so consent before analytics is not their usual requirement; Colorado, for example, requires consent only in specific circumstances, such as sensitive data (Colorado AG, above). They do ask for a notice, a way to opt out where you sell or share, and honoured signals. Europe is different; see Analytics and the GDPR and Analytics without cookies. For Canada, see Analytics and Canadian privacy law.
If I never sell or share, can I ignore Global Privacy Control?
California's regulation does not require a business that neither sells nor shares to process it. Other states word their rules differently, and honouring it anyway costs little.
How AnalyticsTrend does it
AnalyticsTrend is product analytics for websites, browser extensions and apps. It sets no cookies on the people it measures and does not fingerprint. Its identifier is random, kept in the site's or extension's own storage and scoped to one project, so it cannot be joined across sites. The IP address is turned into a country, and in some countries a region, then discarded.
Global Privacy Control is honoured by default: a browser that sends it sends nothing and gets no identifier. In extensions this is best effort, because Firefox and Brave show the signal to an extension's background and Chrome does not. You can turn it off.
Those are design choices, not a finding about your obligations: the data is still tied to a random identifier, and you remain responsible for your notice, your privacy policy and deciding which laws apply to you. What it stores and sends is listed in What it collects; the setup is in Install on a website, Install in a Chrome extension and Install in an app. For the practices behind it, see What privacy-respecting analytics means.
Checked against the California Civil Code, CalPrivacy, the California, Colorado, Connecticut and Texas Attorneys General, the eCFR, the Federal Register and the FTC on 27 October 2026. These laws change often; check the linked pages for the current text.