19 US states now have comprehensive consumer privacy laws in force — up from just California in 2020 (IAPP, 2026). If your WooCommerce store sells to American customers and your consent plugin is configured for GDPR only, you’re exposed. US privacy laws work fundamentally differently from GDPR: they use an opt-out model instead of opt-in, they require honoring browser-level opt-out signals, and CCPA fines hit $2,500 per violation per person. The largest CCPA settlement reached $1.55 million in July 2025 (Smith Anderson/IAPP). Here’s what WordPress store owners need to know — and do — before enforcement catches up.

The American Privacy Patchwork WooCommerce Stores Can’t Ignore#

WordPress store owners have spent years getting GDPR right. Cookie consent banners. Opt-in checkboxes. Privacy policies referencing EU regulations. That work matters — but it covers exactly one jurisdiction.

Meanwhile, the US built its own privacy framework. Not one federal law, but a patchwork of state-by-state regulations that started with California’s CCPA in 2020 and accelerated fast. Three new states — Indiana, Kentucky, and Rhode Island — took effect on January 1, 2026. Eight existing state privacy laws were amended in 2025 with expanded requirements (IAPP, 2025). And California itself didn’t sit still: the 2026 CCPA updates added entirely new rules around automated decision-making, risk assessments, and cybersecurity audits.

The enforcement isn’t theoretical. California’s Attorney General secured the largest CCPA settlement to date — $1.55 million — in July 2025 (Smith Anderson/IAPP).

Here’s the problem for WooCommerce store owners: nearly all WordPress privacy content focuses exclusively on EU/GDPR compliance. If you searched “WordPress privacy compliance” right now, you’d find dozens of GDPR guides and almost nothing about the 19 US state laws that apply the moment an American customer hits your checkout page.

Why GDPR Compliance Doesn’t Cover US Privacy Laws#

This isn’t a case of “close enough.” US state privacy laws are architecturally different from GDPR, and the distinction matters for how your consent plugin needs to work.

GDPR uses an opt-in model. Visitors must actively consent before you collect data. That’s why your cookie banner asks for permission first.

US state laws use an opt-out model. You can collect data by default, but you must provide a clear mechanism for consumers to opt out — and you must honor that opt-out immediately across every platform receiving their data.

Translation: Your GDPR cookie banner that blocks tracking until someone clicks “Accept” is the wrong interface for US visitors. US law requires a “Do Not Sell or Share My Personal Information” link and the ability to process opt-outs retroactively across all data destinations.

12 US states now require honoring Global Privacy Control (GPC) opt-out signals (Secure Privacy, 2026). GPC is a browser-level setting that automatically tells every website a visitor doesn’t want their data sold or shared. If your WordPress consent plugin doesn’t detect GPC signals, you’re violating these laws on every pageview from a GPC-enabled browser — and the visitor never even sees a banner.

This is a consent architecture problem, not a checkbox problem. Your plugin needs to operate in two fundamentally different modes depending on where your visitor is located.

You may be interested in: Do You Actually Need GTM for Your WooCommerce Store?

Who CCPA Actually Applies To (It’s Broader Than You Think)#

Many WooCommerce store owners assume CCPA only applies to big California companies. That assumption is wrong — and expensive.

CCPA applies to any for-profit business that meets any one of three thresholds while processing California residents’ personal information:

• Annual gross revenue of $26.625 million (adjusted from $25 million in January 2025 per Jackson Lewis)
• Buys, sells, or shares personal information of 100,000+ consumers or households annually
• Derives 50% or more of revenue from selling or sharing personal information

Notice: there’s no requirement that your business be located in California. If your WooCommerce store ships to California customers and meets the revenue threshold, CCPA applies. If your store gets 100,000+ unique visitors annually from California — even if they don’t all buy — the data processing threshold could apply.

CCPA fines are $2,500 per violation or $7,500 per intentional violation — calculated per person whose rights were violated (CCPA Civil Code 1798.155). A store with 10,000 California customers and a systematic compliance failure isn’t looking at one fine. It’s looking at $25 million in potential exposure.

And California is just the strictest. The other 18 states have their own thresholds, their own definitions, and their own enforcement mechanisms. Colorado, Connecticut, and Virginia have been active enforcers. Texas expanded its law significantly in 2025.

The 2026 CCPA Expansions Most WooCommerce Stores Haven’t Heard Of#

Even stores already aware of basic CCPA requirements are likely unprepared for California’s 2026 updates. BDO Advisory called 2026 “a pivotal year in which companies will need to reassess and strengthen their privacy programs” to keep pace with increasingly complex and risk-aligned regulations.

The biggest change: Automated Decision-Making Technology (ADMT) requirements. If your WooCommerce store uses any of the following, you now have new disclosure and opt-out obligations for California customers:

• AI-powered product recommendations (“Customers who bought this also bought…”)
• Dynamic pricing based on user behavior or location
• Predictive email segmentation through tools like Klaviyo
• Automated ad targeting that uses personal data for audience creation

If your store uses any form of automated personalization — and most WooCommerce stores do — the 2026 CCPA ADMT rules apply to your California customers.

California also introduced mandatory risk assessments for businesses whose data processing presents “significant risk” to consumer privacy. And new cybersecurity audit requirements add another compliance layer for businesses meeting certain thresholds.

What Your WordPress Consent Plugin Actually Needs to Do#

Here’s a practical checklist for WooCommerce store owners. Your consent plugin setup should handle all of these:

For US visitors:

• Detect Global Privacy Control signals and automatically honor them without displaying a banner
• Provide a “Do Not Sell or Share My Personal Information” link — required text, not optional
• Process opt-out requests across all tracking platforms simultaneously — GA4, Facebook, Google Ads, and every other destination receiving visitor data
• Support state-specific requirements — different states have different threshold tests, different rights, and different enforcement mechanisms
• Maintain records of consent and opt-out requests — enforceable documentation, not just cookie settings

For EU visitors (what you already have):

• Opt-in consent before any tracking fires
• Granular consent categories
• Easy withdrawal of consent

WordPress consent plugins like CookieYes, Complianz, and WPConsent have varying levels of US law support. Some offer CCPA modules; few handle the full 19-state patchwork. Check your specific plugin’s documentation — and verify it detects GPC signals, because that requirement alone catches most stores off guard.

You may be interested in: Your DataLayer Has No Idea Who Just Landed

The Data Deletion Problem Most Stores Can’t Solve#

Here’s where US privacy compliance gets technically difficult for WooCommerce stores.

When a California customer submits a data deletion request — which is their right under CCPA — you don’t just delete their record from WordPress. You need to delete or de-identify their data everywhere it was sent: GA4, Facebook Ads, Google Ads, your email platform, your BigQuery warehouse, and any other system that received their personal information.

If your tracking architecture sends data directly from the browser to each platform via JavaScript pixels, you have no centralized control point. Each platform received data independently, and you need to contact each one separately to process the deletion. With 3-5 tracking platforms, that’s a manual, error-prone process for every single request.

Server-side tracking architectures solve this by routing all data through a single server you control before it reaches any destination. When a deletion request arrives, you have one place where every outbound data flow can be managed. You know exactly which platforms received what data, and you can process deletions systematically instead of platform-by-platform.

Transmute Engine™ takes this further. Because your data flows through a first-party Node.js server on your subdomain before reaching GA4, Facebook CAPI, Google Ads, BigQuery, or Klaviyo, you maintain a centralized processing point and delivery log. When a US customer exercises their opt-out or deletion rights, you have the architectural control to honor that request across every destination simultaneously.

Key Takeaways#

• 19 US states have comprehensive privacy laws in force as of January 2026 — your GDPR-only consent plugin covers one jurisdiction, not twenty
• US laws use opt-out, not opt-in — you need different consent architecture for US visitors than EU visitors
• 12 states require honoring Global Privacy Control signals — if your plugin doesn’t detect GPC, you’re violating the law on every visit from a GPC-enabled browser
• CCPA fines are per-person, not per-incident — $2,500 per violation multiplied by every affected customer adds up fast
• 2026 CCPA ADMT rules affect any store using AI recommendations, dynamic pricing, or predictive email segmentation — most WooCommerce stores with Klaviyo or similar tools are now subject to new disclosure requirements
• Data deletion requests require centralized control — server-side tracking gives you one point to manage opt-outs across all platforms

Frequently Asked Questions#

US privacy enforcement is accelerating. See how Seresa gives WooCommerce stores the data control architecture that US privacy laws demand.