Five New State Privacy Laws Are Live. Is Your Ad Stack Passing the Signals?

What changed in January

Five more U.S. states now have comprehensive consumer privacy laws in force. Delaware, Iowa, Nebraska and New Hampshire took effect on January 1, 2025, and New Jersey followed on January 15. Tennessee (July 1), Minnesota (July 31) and Maryland (October 1) are next on the 2025 calendar. Add the states that were already live, including California, Virginia, Colorado, Connecticut, Utah, Texas and Oregon, and the so-called patchwork now covers a large share of any national publisher's audience.

None of these laws bans programmatic advertising. What they share is a right for residents to opt out of the sale of their personal data and of targeted advertising, plus tighter rules for sensitive data. For ad-supported sites the practical question is not legal theory. It is whether an opt-out made on your page actually reaches every company that touches the impression.

Why local and regional publishers should look first

Large national publishers have had privacy teams on this for years. The newer exposure sits with regional news groups, city magazines and local TV websites, whose audiences are concentrated in the states that just switched on. A metro news site in New Jersey serves mostly New Jersey residents; a statewide outlet in Iowa serves mostly Iowans.

Applicability thresholds differ by state. Delaware's law, for example, reaches organizations that process personal data of 35,000 or more consumers, or 10,000 or more if over 20% of revenue comes from selling personal data. Nebraska's law has no volume threshold and applies to businesses that are not small businesses under federal SBA definitions. Whether you are covered is a question for counsel. Whether your signal plumbing works is a question for ad ops, and it is one you can answer this week.

The signal chain, end to end

Every opt-out should be traceable through four hops:

1. Capture. Your consent management platform (CMP) records the choice, including browser-level preference signals. New Hampshire requires controllers to honor universal opt-out mechanisms such as Global Privacy Control from its January 1 effective date, and New Jersey's requirement to do the same begins July 15, 2025.
2. Encode. The CMP writes the choice into a string partners can read. For U.S. traffic that increasingly means the IAB Tech Lab's Global Privacy Platform (GPP), which carries a U.S. national section as well as state-specific sections.
3. Transmit. Your header bidding wrapper and ad server pass that string with every bid request. In Prebid.js this is handled by the GPP consent management module; on the Google side, confirm how your CMP integration and restricted data processing settings apply to users in these states.
4. Honor. Downstream partners act on the signal. You cannot control their systems, but you do control who receives your requests in the first place.

A one-week audit

Days 1–2: inventory every tag

List each script that can fire an ad request, a pixel or a user sync: header bidding adapters, identity modules, sync iframes, analytics, video players, social embeds and anything a sales team added for a single campaign. Orphaned campaign pixels are the most common leak because nobody owns them after the flight ends.

Day 3: test the opt-out path

In a clean test browser with Global Privacy Control turned on, load your main templates (home, article, gallery, video) and inspect outgoing bid requests. Confirm the GPP string is present, that the relevant section reflects the opt-out, and that user syncs are suppressed where they should be. Then repeat without GPC, using your on-page opt-out link instead. Both paths should produce the same downstream result.

Day 4: check how location is resolved

State sections only help if your CMP applies them to the right visitors. Find out how it determines a user's state, what happens on VPN or corporate traffic, and what it does when location is unknown. Make that fallback a deliberate choice, documented, rather than a default nobody reviewed.

Day 5: prune and paper the vendor list

Every bidder, identity provider and data partner is another place a signal can be dropped. Pull 90 days of revenue by partner and remove the ones that add little. For the ones you keep, make sure contracts include appropriate data processing terms; the IAB's Multi-State Privacy Agreement (MSPA) is one framework many publishers and vendors use to standardize those obligations.

Revenue impact: measure it, don't guess

Opt-outs remove some impressions from audience-targeted demand. They do not remove contextual demand, first-party segments built on your own content, or direct-sold campaigns. Before the rest of 2025's laws arrive, set up reporting that splits impressions and CPM by opt-out status and by state. That turns a vague worry into a number you can plan around, and it tells you where contextual packaging or direct sales effort will pay back fastest.

A few practical tactics hold up regardless of the numbers:

• Keep contextual signals rich. Accurate page categories, keywords and content metadata in bid requests give buyers a reason to bid on opted-out users.
• Separate floors by segment if your stack allows it. Opted-out inventory can clear at different prices; one floor for everything leaves money on the table in one direction or the other.
• Log consent state alongside revenue. When a partner's bid rate drops in one state, you want to know within days whether it is a signal problem or a demand problem.

What's next

Three more laws land this year. Maryland's, effective October 1, is widely viewed as the strictest so far, with data minimization requirements and a prohibition on selling sensitive data. Building a repeatable test now, one you rerun each time a state goes live or a vendor updates its adapter, costs far less than retrofitting under a deadline.

The goal is simple to state: every choice a reader makes on your page should arrive, intact, at every partner in the auction.

If a managed partner runs your wrapper, ask them to walk you through that chain with real bid requests. A good setup can show you the signal at every hop.