Does a Small Business Website Need a Cookie Banner in 2026?

Does Arizona have a law that requires a cookie banner?

No. Arizona has not passed a comprehensive consumer privacy law. The IAPP's state privacy legislation tracker, last updated June 29, 2026, lists Arizona's bill, SB 1815, under inactive bills, not signed laws (IAPP, 2026). Mayer Brown's state privacy law tracker, current as of September 3, 2026, does not list Arizona either (Mayer Brown, 2026).

The two trackers don't even agree on how many states have these laws. The IAPP chart counts 23 signed laws. Mayer Brown lists 24 because it includes Florida, with a footnote saying Florida's law "applies under narrow circumstances," such as companies with over $1 billion in global revenue. That gap is a good reminder that "how many states have privacy laws" depends on who's counting.

None of these laws says "show a cookie banner." When they apply, they require a privacy notice, opt-outs for targeted advertising or data sales, and often opt-in consent for sensitive data. A banner is one way to handle those duties, not the duty itself.

Do the California and Texas laws reach a local service business?

California's CCPA defines a covered "business" partly by revenue. Effective January 1, 2025, that threshold rose from $25,000,000 to $26,625,000 in annual gross revenue (California Privacy Protection Agency, 2025). A Gilbert HVAC company doing $4 million a year sits at about 15 percent of that line ($4,000,000 divided by $26,625,000 is 0.150). The law's other tests turn on handling or selling large amounts of California consumer data, which an East Valley contractor isn't doing.

Texas is the one that surprises people, because its law has no revenue threshold at all. Even so, the Texas Attorney General's own summary says small businesses, as defined by the federal Small Business Administration, are "generally exempt," with one exception: if a small business sells a consumer's sensitive data, it must get consent first (Texas Attorney General, 2024). Sensitive data there includes precise geolocation and health conditions. The Texas law has no private right of action, gives a 30-day cure period after notice, and carries penalties of up to $7,500 per violation.

For an Arizona roofer, Texas almost never matters. A med spa sharing location or health-related data with ad platforms should have a lawyer look at the "sensitive data" language.

What did California's SB 690 actually change?

Plaintiffs' firms have used a 1960s California criminal statute, the California Invasion of Privacy Act, to sue website owners over ordinary tools. Mitchell Silberberg & Knupp describes the targets as "analytics scripts, advertising pixels (e.g., Meta Pixel, TikTok Pixel), session replay software, chat widgets, and mobile SDKs," and notes that firms have filed "thousands of class actions and mass-arbitration demands" (MSK, 2026). The statute allows $5,000 per violation without proof of actual harm, which is why demand letters reach small companies.

A favorite theory used Section 638.51, the "pen register" rule: a script collecting IP addresses works like the old device that logged numbers dialed. Courts split, and many businesses settled early, according to Morgan Lewis (Morgan Lewis, 2026).

Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, a Section 638.51 claim arising from a website or app can be brought only by the California Attorney General. It also reaches back: per MSK, qualifying claims in cases filed on or after January 1, 2025 that are still pending on January 1, 2027 should be barred.

What it did not do matters more. SB 690 "does not repeal § 638.51, does not declare any tracking technology lawful, and does not create a safe harbor," MSK writes. The wiretapping and eavesdropping sections, 631 and 632, are untouched, and Morgan Lewis reports that plaintiffs "have already signaled their intent" to refile under them.

Can a California lawsuit really hit an Arizona contractor?

It can. We have not found a reliable public count of CIPA suits against small Arizona businesses, and we won't invent one. The law firm alerts describe a volume business built on visits from California residents.

Phoenix sites get steady California traffic. If a Scottsdale med spa or Peoria injury firm fires a Meta Pixel on page load, records sessions, or runs a chat widget that sends conversations to a vendor, it fits the pattern plaintiffs describe.

The surviving claims are harder to bring. Section 631 requires proof that a third party captured the "contents of a communication" while it was "in transit," Morgan Lewis notes. That's a higher bar than "your script logged my IP address." But it points straight at the tools that touch what visitors type. Morgan Lewis specifically flags that "search bars and chat boxes may feature more prominently in the next wave of CIPA litigation."

Your contact form, chat bubble, booking widget and call recording are where visitors type real words. Check those first.

What on your website actually creates the risk?

Cookies themselves are not the problem. A cookie that keeps a visitor logged in, or remembers what's in a cart, is not what these lawsuits target. The risk comes from tools that send visitor behavior to a third party, usually an ad platform or a software vendor.

On the service business sites we look at, those tools tend to be:

• Ad pixels like the Meta Pixel, often installed for one campaign and never removed.
• Google Ads remarketing tags and analytics set to share data for ad personalization.
• Session replay or heatmap tools that can record what people type.
• Third-party chat widgets and AI chatbots that pass conversation text to an outside vendor.
• Booking, financing or review widgets that load their own trackers.

The common thread is a third party learning about a visitor who never agreed to it. Remove the third party, or get agreement first, and most of the theory falls apart.

We covered the measurement side in our post on Google Ads conversion tracking for service businesses: you need a few clean conversion signals, not eleven overlapping scripts. If you use a chat tool, pick one where you control where the conversation data goes, which is a big reason our website chatbot setup keeps transcripts in the client's own system.

What about Google's consent requirements?

Google has its own rules, separate from any state law, and they are clear about scope. Google's help page on consent mode says advertisers must follow its EU user consent policy to use ad personalization and measurement with Google tags, and that "if a user from the EEA is using your website or app and you measure user behavior with Google tags, you need to pass through end-user consent choices to Google" (Google Ads Help, 2026).

For a Chandler roofing company, European traffic is close to zero, so this mostly matters only if you get real international visitors.

One detail on that page matters for everyone. Google warns that if you block your Google tags from loading until a visitor interacts with your banner, without consent mode, "Google won't be able to verify user consent choices and this may lead to loss in data." In plain terms, a strict banner wired up badly can make your Google Ads conversion numbers worse. If you add a banner, the person installing it needs to understand how it talks to your tags.

This short Google Ads tutorial is worth a few minutes for one thing: watch how missing consent signals affect your remarketing lists.

Video: Google Ads, "Google Ads Tutorials: Maintain tag-based remarketing by capturing consent."

Is it different for dental offices, med spas and clinics?

If your practice is a HIPAA covered entity, the federal health privacy rules sit on top of everything above. The HHS Office for Civil Rights bulletin on tracking technologies says that tracking tools on "user-authenticated webpages generally have access to PHI," which can include an IP address, medical record number, appointment dates "or other identifying information" (HHS Office for Civil Rights, 2024). Patient portals and logged-in booking pages fall in that bucket.

The public side of the site is murkier. On June 20, 2024, a federal court in Texas vacated the part of the bulletin that said HIPAA is triggered when a tracker connects an IP address with a visit to a public page about specific health conditions or providers. HHS's page now says it "is evaluating its next steps in light of that order." So the rule for public pages was narrowed, while the rule for logged-in pages stands.

Our read: keep ad pixels off any page where a patient logs in, books with health details, or fills out intake. Whether your med spa is a covered entity is a question for your compliance advisor, but the safe setup costs little. We went deeper on this in our post on medical website tracking pixels.

Does a cookie banner hurt leads or ad performance?

It can. A banner adds friction on the pages where you want someone to call, and on a phone a bottom banner can cover the click-to-call button. That's solvable, but many off-the-shelf banners ignore it.

The data cost is real too. Fewer measured conversions means smart bidding has less to learn from. We have not seen a reliable independent study putting a percentage on lost conversions for local service businesses, so we won't quote one.

A banner that blocks trackers until consent is a strong defense, which is what MSK and Morgan Lewis recommend. A banner that says "we use cookies" while every script fires anyway gives you the friction with none of the protection.

What would we do?

Our recommendation starts with removing things, not buying something.

Step one: inventory your scripts. Ask whoever manages your site to list every third-party script and pixel that loads. If they can't, that's a finding by itself.

Step two: delete what you don't use. If you aren't running Meta ads, the Meta Pixel goes. If nobody has opened the heatmap tool in a year, it goes. Morgan Lewis makes the same point: cookies "that present marginal business value may be considered for removal." Your site usually gets faster too.

Step three: decide based on what's left.

• If all that's left is first-party analytics, your contact form and call tracking that doesn't send form contents to an ad platform, we'd skip the banner. Keep an accurate privacy policy that says what you collect and why.
• If you run ad pixels or remarketing, or a chat tool that sends text to a vendor, and you get California visitors, we'd add a banner that truly blocks those tools until consent and is wired to Google consent mode, so your Google Ads data doesn't fall apart.
• If you're a healthcare practice, keep pixels off logged-in and intake pages no matter what, and talk to your compliance advisor about the rest.

When not to buy from us: if your site is a simple brochure site with a form and Google Analytics, you don't need a consent platform subscription or a "privacy compliance package" from anyone, including us. A one-time script cleanup and a privacy policy review is the whole job.

If you want a second set of eyes, our free audit includes a list of every third-party script your site loads. If you're weighing a rebuild, our website services page explains how we build sites that load only what they need, and our pricing is public.

What should your privacy policy say?

Even when no law forces a banner, a clear privacy policy is worth having, and several state laws require one once they apply. The Texas AG's summary lists what a compliant notice covers: the categories of data processed and why, what you share with third parties, the categories of those third parties, and how consumers can exercise their rights.

That list is a good template even if no law reaches you. In plain English, say what your forms collect and why, which tools measure traffic, and whether you share anything with ad platforms. If you record calls, say so and play a notice. California's Section 632 is the eavesdropping provision, and MSK notes that 632 and 632.7 claims often aim at "chat features and call-related technologies."

The worst policy is an old generator copy that doesn't match your tools. If it says you don't share data with advertisers while a Meta Pixel fires on every page, you've written evidence for the other side.

Update it whenever you add or remove a tool. It's part of normal Phoenix website upkeep.

Questions owners ask

Is a cookie banner legally required for an Arizona small business website?

No Arizona law requires one, because Arizona has no comprehensive consumer privacy law. The IAPP tracker, updated June 29, 2026, lists Arizona's SB 1815 as inactive. You may still choose a banner if your site runs ad pixels or chat tools and gets California visitors.

Does the CCPA apply to my Arizona business if Californians visit my site?

Probably not if you're a typical local service company. The CCPA's revenue threshold is $26,625,000 in annual gross revenue as of January 1, 2025, per the California Privacy Protection Agency, and the other tests turn on handling large amounts of California consumer data. A local contractor rarely meets any of them.

Did SB 690 end website tracking lawsuits in California?

No. Starting January 1, 2027, SB 690 lets only the California Attorney General bring pen register claims under Section 638.51 tied to websites and apps. Private wiretapping and eavesdropping claims under Sections 631 and 632 are unaffected, and law firms expect plaintiffs to refile under those sections.

Will a cookie banner hurt my Google Ads results?

It can if it's set up badly. Google's help page warns that blocking Google tags until a visitor interacts with the banner, without consent mode, "may lead to loss in data." If you add a banner, make sure it's connected to Google consent mode.

Do I need a banner if I only use Google Analytics and a contact form?

In our view, usually not for an Arizona business with local customers and no European traffic. Keep an accurate privacy policy, and make sure your form data isn't being sent to ad platforms. If you later add pixels or remarketing, revisit the decision.

What should a dental office or med spa do differently?

Keep advertising pixels and third-party trackers off patient login pages, intake forms and booking pages that collect health details. HHS says trackers on logged-in pages generally have access to protected health information. The rule for public pages was narrowed by a June 2024 court order, but the logged-in guidance stands.

Sources

• Morgan Lewis: California Eliminates Private Right of Action Under CIPA's Pen Register and Trap and Trace Provision (2026)
• Mitchell Silberberg & Knupp: California SB 690 Ends Private Right of Action for Pen Register and Trap-and-Trace Claims Under CIPA (2026)
• California Privacy Protection Agency: Updated Monetary Thresholds in CCPA (2025)
• Texas Attorney General: Texas Data Privacy and Security Act (2024)
• IAPP: US State Privacy Legislation Tracker (2026)
• Mayer Brown: State Privacy Law Tracker (2026)
• Google Ads Help: Updates to consent mode for traffic in the European Economic Area (2026)
• HHS Office for Civil Rights: Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (2024)