Lawsuits over website tracking technology in California are showing up more often, and they're increasingly targeting things store owners don't always think of as "cookies" at all: tracking pixels, session replay tools, and analytics scripts that fire the moment a visitor lands on a page, before that visitor has made any choice about being tracked.
The legal landscape here is still unsettled. There's no single court ruling that resolves how these claims apply to every tracking tool on every site. But for stores serving California visitors, that uncertainty is exactly the reason to consider a more cautious setup, one where non-essential tracking stays blocked until a visitor actively consents.
What's actually being targeted
The claims we're seeing aren't limited to traditional advertising cookies. They increasingly reach:
- Pixels from ad platforms that fire on page load
- Session replay tools that record visitor behavior in the background
- Analytics scripts that start collecting data before any banner interaction
The common thread is timing. If a tracking technology starts collecting data before the visitor has had a chance to say yes or no, that's the moment drawing scrutiny.
The setup Consentmo recommends for California
For visitors browsing from California, we recommend a banner with three clear choices: Accept all, Reject, and Preferences, with non-essential tracking blocked by default until the visitor makes a selection. Essential store functions, like the cart, checkout, and core site operations, aren't affected by this and continue to work normally regardless of the visitor's choice.
This is a deliberate step up from the default many stores currently run, where tracking is allowed to fire immediately and consent is more of a formality collected after the fact. The cautious version flips that order: nothing tracks until there's a choice, and only the choice made determines what runs next.
How to set this up in Consentmo
If you already have Consentmo installed and have the United States enabled as a region, this is a change you can make directly in your existing settings. We put together a short walkthrough covering exactly where to click:
The short version of what it covers:
- In Consentmo, go to Cookie Banner → Regions and enable Smart Geotargeting. This shows the banner only in the roughly 20 U.S. states that currently have an active privacy law, rather than every visitor nationwide.
- Under Manage Regions, open United States → California. Because California is where most of the current lawsuit activity is concentrated, it gets its own configuration separate from other U.S. states.
- Change the cookie state from the default (tracking allowed until the visitor acts) to Accept / Reject / Preferences, with tracking blocked before consent.
- Expand the settings to confirm no cookies are set to fire before the visitor's choice, then save.
This change only affects the California configuration. Every other U.S. state you have active keeps its existing setup.
The trade-off
Blocking tracking until consent means you'll likely see a dip in analytics and ad data from visitors who decline, or who simply haven't interacted with the banner yet. That's the direct cost of this approach, and it's worth weighing against your own risk tolerance and how much of your traffic comes from California.
We've heard from legal counsel that this more conservative setup tends to reduce the likelihood of receiving a demand letter in the first place. But there's no guaranteed outcome either way, and the choice of how cautious to be is yours to make based on your own business.
One more thing to check
If you use tracking tools installed outside of Consentmo, through theme code edits, third-party apps, or a tag manager, those may need separate configuration to respect the same consent choice.
Consentmo can block scripts it's aware of, but anything injected independently of the app may keep firing unless it's connected to the same consent signal.
If you're not sure whether something in your stack falls into that category, our team can help you check.
