How Do US State Privacy Laws Affect Meta Ads?

Meta ties its US privacy option, limited data use, to named states. As checked on 2 Oct 2026, Meta’s table lists California plus 13 other states. What a state law asks of your business comes from the law itself, and what the flag does comes from Meta. This page keeps the two apart. It is not legal advice, so read the linked pages and ask a qualified adviser about your own case.

What differs from state to state?

On Meta’s side, availability differs by state and by product. Meta says it began offering limited data use in 2020, after the California Consumer Privacy Act took effect, and expanded it as it evaluated changes in other state privacy laws. California is covered for Meta business tools, the Audience Network SDK and customer list custom audiences. The other 13 states in the table are covered for the first two but not for customer lists. Meta says it decides whether a person lives in a listed state unless you add state-specific location parameters.

On the law’s side, the California Attorney General’s page says only California residents have rights under the CCPA, even when they are temporarily outside the state. This page does not describe other states’ laws. Meta’s table names them, and each state’s own official page is the place to read them.

What you can do: find out which states your customers live in, then check each state’s own page.

What does California’s attorney general say about ad data?

The page, updated on 28 August 2026, lists a right to opt out of the sale or sharing of personal information, including through a user-enabled global privacy control. It explains that “sharing” means sharing for cross-context behavioral advertising: targeting ads at a person using personal information from their online activity across numerous websites. Whether your own setup counts is a legal question for your adviser.

Other points from the page:

• A business must respond to an opt-out as soon as feasible, up to a maximum of 15 business days.
• After an opt-out, a business cannot sell or share the person’s information unless they later authorize it, and it must wait at least 12 months before asking them to opt back in.
• The law applies to for-profit businesses that do business in California and meet any of three tests: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50% or more of annual revenue from selling it.

The page calls itself general consumer information, not legal advice.

Where does Meta’s flag fit in?

Meta says that when you send the flag, it processes flagged personal information in line with its role as a service provider or processor and restricts use under its state-specific terms. Meta also says it is up to you, with your legal counsel, whether and when to send it.

The attorney general’s page says service providers are treated differently from the businesses they serve, and that it is the business that is responsible for responding to consumer requests. So decide with your adviser how requests reach you and how they reach your tags. Read the details in the entry on limited data use.

What do Meta’s business tools requirements say?

Meta says its privacy and data use requirements apply to all Meta business tools, browser-side and server-side. Meta says you need a lawful basis and any necessary consents before sharing information with Meta. Where consent is required, set tools so no data reaches Meta before it is given. Do not share health information, financial information or other sensitive categories, and Meta says you are ultimately responsible for what you share.

What you can do: audit what your pixel and server events send, then remove anything on that list.

FAQ

Does Meta’s flag cover every US state?

No. As checked on 2 Oct 2026, Meta’s table lists California plus 13 other states, and options differ by product. Customer list custom audiences can currently be flagged only for people in California. Check Meta’s page for the current table, because Meta says it has expanded the list over time.

Does California’s law apply to a business based elsewhere?

The attorney general’s page says the CCPA applies to for-profit businesses that do business in California and meet any one of three tests. Whether you meet them is a question for a qualified adviser.

Can a person opt out with a browser setting?

The California page says a user-enabled global privacy control is one acceptable way to opt out of sale or sharing, and it is available on some browsers or as an extension. Meta says its flag can be used when you receive such a signal from people in California or Colorado.