Is website visitor identification legal in USA? What US regulators and vendors say

Is website visitor identification legal in USA: what the sources say

The privacy pages of the FTC and of California, Colorado, Oregon and Texas give no yes or no for website visitor identification. They set conditions on notices, privacy policies, opt-outs and data brokers instead. This page is not legal advice: have counsel review your own privacy policy and cookie banner.

The California Attorney General's CCPA page, updated August 28, 2026, says only California residents have rights under the CCPA. The FTC's privacy and security guidance for businesses tells companies to reread their privacy policy and keep its promises.

California: CCPA tests and business contacts

The Attorney General lists three tests for who the CCPA covers: gross annual revenue over 25 million dollars; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50% or more of annual revenue from selling California residents' personal information. The California Privacy Protection Agency adjusts that revenue figure for inflation every other year, and its FAQ gives a higher amount, effective January 1, 2025.

RB2B says many companies under 25 million dollars in revenue are not subject to most CCPA requirements. The Attorney General's list has three tests, and revenue is only one of them.

The Attorney General also says the exemptions for employment-related and business-to-business personal information expired on December 31, 2022. It says the CCPA requires a notice at or before the point of collection and a privacy policy that states consumers' rights.

Data broker registration and DROP

The California Privacy Protection Agency's registry defines a data broker as a business that collects personal information about consumers from various sources and sells it to other companies. The registry page, last updated July 29, 2026, lists GETEMAILS LLC, doing business as RETENTION.COM and RB2B, in Austin, Texas.

RB2B says it is also registered in Texas, Vermont and Oregon. The Texas Secretary of State says registration does not imply approval or endorsement. Under California's Delete Request and Opt-out Platform (DROP), residents can send one request to all active data brokers, and brokers must begin processing those requests on August 1, 2026.

Opt-out signals in Colorado and Oregon, and the Texas act

A global privacy control (GPC) is a browser setting that tells a site not to sell or share the visitor's data, and California lists it as one acceptable opt-out method. Colorado's Attorney General says controllers must accept universal opt-out mechanisms from July 1, 2024, and that its law covers residents in an individual or household context, not an employment or business-to-business one.

Oregon's Department of Justice says businesses over its thresholds must honor opt-out preference signals from January 1, 2026, and keep a clear opt-out link on their websites. Texas's Attorney General enforces the Texas Data Privacy and Security Act, effective July 1, 2024.

What a vendor's terms ask of your site

RB2B says compliance responsibility rests entirely with you as the website administrator, and its terms require its sample privacy-policy wording, or comparable wording your counsel approves, on your site; is RB2B legal goes through those terms and its help articles.

The terms also make you solely responsible for your use of the data RB2B returns, and state that RB2B gave no notices and got no consents for you. RB2B's FAQ recommends an opt-out link, and its Compliance FAQs list one for California residents. RB2B publishes its sample privacy-policy sentence in more than one version, so copy the current one from its Updating Your Privacy Policy article and have counsel review it.

Write the privacy wording before RB2B's 7-day trial starts matching live visitors. RB2B's articles disagree on whether its script may run before consent, so have counsel settle the cookie banner for your site. For the tools, see best website visitor identification software for USA and identify anonymous website visitors.