CCPA, a growing list of state privacy laws, Global Privacy Control, and FTC rules: what US online stores have to get right in 2026, what violations cost, and a 12-point checklist for Shopware and Shopify.
US privacy law for online stores is a patchwork: no single federal privacy law, but California’s CCPA, a growing list of state privacy laws, and FTC rules that apply no matter where you are based. Most mistakes happen in three places: tracking pixels, opt-out handling, and contracts with tech vendors.
California’s privacy regulator fined retailer Tractor Supply $1,350,000 in September 2025, the largest fine in the agency’s history. One of the findings: the company did not honor opt-out signals such as Global Privacy Control. Earlier in 2025, clothing retailer Todd Snyder paid $345,178 because its privacy portal left opt-out requests unprocessed for 40 days.
If you know which state laws apply to you, honor opt-outs (including browser signals), and have proper contracts with every vendor that touches customer data, you cover most of the risk. The checklist in this article walks you through the twelve most important points.
This article is for US merchants who want their online store set up correctly without going to law school. You will learn which rules apply in 2026, what the state thresholds are, what regulators are actually enforcing, and how to put it into practice in Shopware 6 and Shopify. If you also sell to customers in the EU, you will find a short section on how GDPR differs.
I am a TÜV-certified data protection officer (a European certification focused on GDPR) and I handle privacy and compliance topics in solution25’s ecommerce projects. Everything US-specific in this article is backed by official sources: statutes, regulator websites, and enforcement announcements, all listed at the end. This article is general information, not legal advice. For decisions about your specific business, talk to a privacy attorney licensed in the relevant state.
An online store handles personal information almost everywhere: on page views, in the cart, at checkout, in email marketing, and in customer accounts. In the US, the rules depend on where your customers live, how many of them you have, and what you do with their data.
| Area | What is required | Legal basis | Risk if you get it wrong |
|---|---|---|---|
| Opt-out of sale/sharing | “Do Not Sell or Share My Personal Information” link, honor Global Privacy Control | CCPA, Colorado and Connecticut privacy acts, other state laws | Fines, AG enforcement |
| Privacy policy | Complete, current, explains consumer rights and how to use them | CCPA, state privacy laws, FTC Act Section 5 | Fines, FTC action for broken promises |
| Email marketing | Working unsubscribe, honored within 10 business days, postal address in every email | CAN-SPAM Act | Up to $53,088 per email |
| Vendors | Contracts with privacy terms for everyone you disclose data to | CCPA, state privacy laws | Fines |
| Consumer requests | Respond to access, deletion, and correction requests within 45 days | CCPA, state privacy laws | Fines |
| Data security | Reasonable security, breach notification | State breach laws, FTC Act, CCPA | Damages, lawsuits, fines |
| Children | Parental consent before collecting data from kids under 13 on child-directed sites | COPPA Rule | FTC enforcement |
Here is the biggest difference from Europe: US state privacy laws generally work on an opt-out model. You can usually run analytics and ad cookies without asking first, but you must give people an easy way to say no, and then actually stop. That sounds simple. In practice, the opt-out is exactly where regulators are finding problems.
In May 2025, the CPPA fined clothing retailer Todd Snyder $345,178. Its privacy portal was not configured correctly, so opt-out requests went unprocessed for 40 days. The company also asked for more information than necessary and required identity verification before people could opt out. The head of the CPPA’s Enforcement Division put it plainly: using a consent management platform “doesn’t get you off the hook for compliance.”
Practical tip: Install a browser or extension that supports GPC, open your store in a private window with developer tools open, and check which marketing and analytics requests still go out. If your ad pixels fire as usual, you have work to do.
State privacy laws apply based on where your customers live, not where your company is registered. A store in Texas that sells to Californians can fall under the CCPA. Each law has its own thresholds, and they are lower than many merchants expect.
| State | Applies if you (in short) | Key date |
|---|---|---|
| California (CCPA) | Annual gross revenue over $26,625,000, or buy, sell, or share personal information of 100,000+ California residents or households, or earn 50%+ of revenue from selling it | Updated regulations in effect since January 1, 2026 |
| Virginia | Process data of 100,000+ consumers, or 25,000+ consumers and over 50% of gross revenue from selling data | In force |
| Colorado | Process data of more than 100,000 people per year, or earn revenue or discounts from selling data of 25,000+ | GPC must be honored since July 1, 2024 |
| Connecticut | Process data of 35,000+ consumers, or process any sensitive data, or offer personal data for sale | July 1, 2023, opt-out signals required since January 1, 2025 |
| Texas | No numeric threshold; small businesses as defined by the SBA are generally exempt | July 1, 2024 |
| Indiana, Kentucky | 100,000+ residents, or 25,000+ and at least half of revenue from selling data | January 1, 2026 |
| Rhode Island | 35,000+ customers, or 10,000+ and more than 20% of revenue from selling data | January 1, 2026 |
The table is a selection, not a complete list: more states have comparable laws, and thresholds keep moving. Payment-only data is excluded from the counts in some states, such as Connecticut and Rhode Island. If you are near a threshold in any state, assume you are covered and build your setup for the strictest rules you face.
According to the European Commission, GDPR applies to companies outside the EU when they offer goods or services to people in the EU or monitor their behavior there. If you actively market and ship to EU customers, plan for three big differences: non-essential cookies and tracking generally need opt-in consent before they run (not just an opt-out), every processing activity needs a legal basis, and fines can reach €20 million or 4% of global annual turnover. In practice, many merchants run region-specific settings: opt-in for EU visitors, opt-out with GPC support for US visitors.
Tracking is not banned in the US, but ad pixels change your legal position. When Meta, Google, TikTok, or another ad platform receives data from your store to target people across other sites, that usually counts as “sharing” under the CCPA and as targeted advertising under other state laws. That triggers the opt-out duties above, and your privacy policy has to say so.
Be extra careful with sensitive data. In 2023, the FTC announced a proposed $1.5 million civil penalty against GoodRx because, according to the FTC, the company shared customers’ health information with Facebook, Google, and other companies despite promising not to. If you sell products that reveal health conditions or other sensitive traits, check what your pixels transmit, such as product names or category URLs. In Connecticut, processing sensitive data alone can bring you under the state law, and California gives consumers a right to limit how sensitive information is used. Simple wins: list every tool in your privacy policy, connect your tags to your consent and opt-out status, and consider server-side tagging so you control exactly what leaves your store.
For commercial email, the federal CAN-SPAM Act does not require prior consent. According to the FTC, you must include a clear way to unsubscribe, honor unsubscribe requests within 10 business days, keep the opt-out working for at least 30 days after sending, include a valid physical postal address, use accurate headers and non-deceptive subject lines, and identify the message as an ad. The FTC lists penalties of up to $53,088 for each email that violates the law.
Two practical notes: First, a confirmed opt-in (double opt-in) is still smart because it keeps your list clean and gives you proof of consent. Second, if you mail customers in the EU, GDPR and EU rules on electronic marketing generally require consent, so the US approach is not enough for those subscribers.
Your store does not run alone. Your host, payment provider, email platform, fulfillment partner, review app, and support software all handle customer data. Under the CCPA and the other state laws, the vendors that process data for you need a written contract with privacy terms that limits what they can do with it. Tractor Supply’s $1,350,000 fine in 2025 included exactly this point: the CPPA found the company disclosed personal information to other companies without contracts containing the required privacy protections.
The large platforms usually offer a data processing addendum in their terms or account settings. Someone just has to check it, accept it where needed, and file it. Keep a simple data inventory as well: which tool gets which data, for what purpose, and under which contract. It sounds like paperwork, but it is the table every privacy audit starts with. If you serve EU customers, check whether your US vendors participate in the EU-U.S. Data Privacy Framework or offer standard contractual clauses.
For what a solid hosting setup looks like, see our article on Shopware Hosting 2026.
Under the CCPA, customers can ask what you know about them, have it deleted, correct it, and opt out of sale or sharing. You have 45 calendar days to respond to requests to know, delete, or correct, with a possible 45-day extension if you tell the customer. Opt-out requests are stricter: as soon as feasibly possible, at most 15 business days. Colorado, Indiana, and Kentucky also use a 45-day deadline with a possible 45-day extension. A short, informal email can be a valid request, so decide internally who answers them and how you verify identity for access and deletion requests.
Deletion has limits. Records you have to keep, for example for taxes or accounting, can generally stay, but marketing data, tracking profiles, and inactive accounts need a retention schedule with clear deadlines. And do not forget job applicants: Tractor Supply was also fined for not informing California job applicants about their privacy rights.
Both platforms bring much of what you need. It just has to be configured for US rules, not only for GDPR. These are the points we check in every project:
US privacy enforcement is real, and retailers are among the companies being fined. Under the CCPA, administrative fines and civil penalties are up to $2,663 per violation and up to $7,988 per intentional violation or violation involving consumers under 16. These amounts apply since January 1, 2025 and are adjusted every odd-numbered year.
| Company | Amount | Reason (per the regulator) |
|---|---|---|
| Tractor Supply (CPPA, 2025) | $1,350,000 | Privacy policy, job applicant notices, opt-outs including GPC, vendor contracts |
| GoodRx (FTC, 2023) | $1,500,000 (proposed order) | Shared health data with advertisers despite privacy promises |
| Todd Snyder (CPPA, 2025) | $345,178 | Opt-out requests unprocessed for 40 days, excessive verification |
| Data breach (CCPA private lawsuits) | $107 to $799 per consumer per incident | Statutory damages, or actual damages if greater |
Other states have their own penalties. Kentucky and Texas, for example, allow civil penalties of up to $7,500 per violation after a 30-day cure period. On top of that, the FTC can act against any company whose privacy promises are deceptive or whose data practices are unfair, regardless of size. For smaller stores, the realistic risk is less a record fine and more a warning letter, a complaint, or a lawsuit after a breach, and the problems behind them are almost always the ones in this article.
In most US states, there is no general requirement for an opt-in cookie banner. What you do need, if a state privacy law applies to you and you sell or share personal information (for example through ad pixels), is an easy opt-out: a “Do Not Sell or Share” link or privacy choices page, plus automatic handling of Global Privacy Control. Visitors from the EU generally need opt-in consent before non-essential cookies run.
It can. The CCPA applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue over $26,625,000 (adjusted from $25 million as of 2025), buying, selling, or sharing personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling it.
If you are covered by the CCPA and sell or share personal information, yes: the California Attorney General says GPC must be honored as a valid opt-out request. Colorado has required universal opt-out signals since July 1, 2024 and Connecticut since January 1, 2025. Tractor Supply’s $1,350,000 fine in 2025 included a failure to honor such signals.
Under the CCPA, up to $2,663 per violation and up to $7,988 per intentional violation or violation involving consumers under 16. In 2025, retailer Todd Snyder paid $345,178 and Tractor Supply $1,350,000. Under CAN-SPAM, the FTC lists penalties of up to $53,088 per violating email.
Not under federal law. CAN-SPAM is an opt-out law: every marketing email needs a working unsubscribe link, a valid postal address, accurate headers, and honest subject lines, and you must honor opt-outs within 10 business days. Double opt-in is still good practice, and subscribers in the EU generally require consent.
Only if your site is directed at children under 13 or you have actual knowledge that you collect personal information from children under 13. In that case, you need parental consent before collecting it. The FTC’s amended COPPA Rule took effect on June 23, 2025, with a compliance deadline of April 22, 2026.
It can. According to the European Commission, GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behavior. A store that actively targets EU customers is covered; a site not aimed at the EU generally is not, even if EU residents occasionally use it. GDPR fines can reach €20 million or 4% of global annual turnover.
Under the CCPA, within 45 calendar days for requests to know, delete, or correct, with one 45-day extension if you notify the customer. Opt-out requests must be handled as soon as feasibly possible and within 15 business days at most. Colorado, Indiana, and Kentucky also use a 45-day deadline.
We review your store’s opt-out setup, Global Privacy Control handling, tracking, checkout, and vendor contracts and show you where action is needed. As a Shopware and Shopify agency with an office in New York (60 East 42nd Street, Suite 1201, phone +1 929-264-7602), we implement the fixes too, from consent configuration to data deletion workflows. This is a technical review, not legal advice.
Henrik Schäfer is a TÜV-certified data protection officer and handles privacy and compliance topics in ecommerce projects at solution25. He helps merchants put privacy requirements into practice without losing sight of conversion. Get in touch
Last updated: November 2026. Next content review: February 2027. This article is general information and not legal advice.
