US Privacy Checklist

The 1Consent US framework renders the opt-out notice, honors Global Privacy Control (GPC), and emits the correct IAB GPP signal for your visitor's state — automatically, per visitor. A few obligations, however, live outside any CMP widget, in your own pages and backend. This checklist covers them.

1. Add a "Your Privacy Choices" link to your footer

California's CCPA regulations (§ 7026(a)(4)) require the opt-out to be reachable through a standing link on your homepage — a banner that appears once and can be dismissed is not an acceptable opt-out method on its own. Most sites satisfy this with a footer link on every page, labeled either:

• "Your Privacy Choices" (may be accompanied by the official opt-out icon, which 1Consent's floating trigger already displays), or
• "Do Not Sell or Share My Personal Information"

1Consent gives you two ways to satisfy this:

Option A — the built-in floating trigger. The US framework force-enables a persistent "Your Privacy Choices" trigger button with the official California opt-out icon. If the trigger is visible on every page, the standing-link requirement is met.

Option B — your own footer link. If you prefer a plain footer link (or your design hides the trigger), open the preference center from any element:

<a href="#" onclick="window.__1consent.cmp.openDetails(); return false;">
  Your Privacy Choices
</a>

If you host a dedicated opt-out page instead, set its URL in Dashboard → Framework → US Legal Settings → Opt-out link URL and the CMP's built-in "Do Not Sell" legal link will point there.

2. Texas: sensitive & biometric data notices

The Texas Data Privacy and Security Act requires two verbatim notice strings if they apply to you. They must appear in the same location and manner as your privacy notice — typically at the top of your privacy policy:

NOTICE: We may sell your sensitive personal data.

NOTICE: We may sell your biometric personal data.

These are static disclosures on your site, not consent-layer behavior — a CMP cannot add them for you. If you sell neither category, no notice is required. If you process (but don't sell) sensitive data, the standard opt-out and the CMP's "Limit the Use of My Sensitive Personal Information" control (enable it in US Legal Settings when applicable) cover you.

3. Logged-in users: propagate GPC to the account

1Consent honors GPC per browser: a visitor with GPC enabled is automatically opted out of sale/sharing in that browser, and the GPP signal reflects it.

Recent California enforcement (the Disney investigation, February 2026) established a stricter expectation for sites with user accounts: when a logged-in user sends GPC, the opt-out must propagate to their account — server-side, across all their devices and sessions — not just the browser that sent the signal.

That propagation happens in your backend, outside the CMP widget:

1. On authenticated requests, read the Sec-GPC: 1 header (or navigator.globalPrivacyControl client-side).
2. When present, record the opt-out on the user account, not just the session.
3. Apply the account-level opt-out to every downstream sale/share of that user's data — including server-side integrations (CAPI, data warehouse syncs, ad audiences) that never see the visitor's browser.

4. What 1Consent already handles

For contrast, none of the following needs work on your side:

• Opt-out-model notice — the US framework shows an informational notice with opt-out controls (no cookie-wall, no pre-consent blocking).
• GPC honoring — detected and applied automatically, with the "signal honored" confirmation the California regulations expect.
• IAB GPP signal — the __gpp API and GPP string are emitted per visitor, using the visitor's state section (California, Virginia, Colorado, Connecticut, Florida) or the US National section elsewhere, following the MSPA single-section rule.
• Sensitive-PI limit control and minors handling — configurable in Dashboard → Framework → US Legal Settings.
• CMP health monitoring — if the notice ever fails to render or an opt-out fails to persist, the failure is reported to your analytics dashboard so silent breakage doesn't become your violation.