Compliance

CCPA and website visitor identification in the US

Last updated: 8 October 2026

US visitor identification is more permissive than the UK and EU, which is why person-level data is common. Here's what CCPA means for it. General information, not legal advice.

The short answer

In the US, website visitor identification is more permissive than in the UK and EU, which is why US tools often identify individuals. The main rule to know is the CCPA in California, which gives consumers rights over their personal information, including the right to opt out of its sale or sharing. For B2B identification you still need to respect those rights and be transparent. (General information, not legal advice.)

State laws, not one federal rule

The US has no single federal privacy law like GDPR. It has state laws, with California's CCPA the most influential. That looser framework is why person-level identification is more common in the US.

It is not a free-for-all. CCPA gives Californians rights to know, delete, and opt out, and other states have their own laws. Honest tools provide notice and an easy opt-out, and they avoid grey-area data practices. It is the mirror image of the stricter UK and EU position.

The honest catch: "allowed in the US" is not "allowed everywhere or anyhow". Check the states you operate in, give clear notice, and honour opt-outs. If a tool waves away US privacy law entirely, be cautious. (General information, not legal advice.)

Frequently asked questions

Is website visitor identification legal in the US?

It is more permissive than in the UK and EU, which is why person-level identification is common. State laws like CCPA still apply.

What is CCPA?

California's consumer privacy law, giving people rights to know, delete, and opt out of the sale or sharing of their personal information.

Does CCPA apply to B2B identification?

Yes, where it covers the personal information involved. You still need notice and an easy opt-out.

Identify US visitors with clear notice and an easy opt-out.

See our CCPA opt-out