Multi-State Privacy Law (MSPL): One Setup for All Your U.S. Visitors

The U.S. does not yet have one federal privacy law. Instead, states have been passing their own, each with its own scope, thresholds, and consumer rights. For a site owner without a legal team on staff, keeping a domain group and geolocation rule current for every state is a lot of ongoing work. MSPL is built to remove that work.

What Is the MSPL Template?

MSPL, short for Multi-State Privacy Law, is a legislation preset inside the Cookiebot Admin Interface. Rather than asking you to configure and maintain a separate setup per state, it gives you one configuration that covers your entire U.S. audience.

Behind the scenes, the template aggregates the strictest applicable requirements from the states with active privacy laws into a single, cohesive setup. Select it once, and it applies automatically to all your U.S.-based visitors. There is no per-state geolocation matrix to build or keep up to date.

Why a Single Template Beats a State-by-State Setup

Many small teams and web agencies managing U.S. sites do not have the legal resources or the time to track which states require what, or to update banner logic every time a new law takes effect. A state-by-state approach also means more configurations to test, more edge cases at state borders, and more maintenance every time a legislature amends a law.

MSPL is built to run without ongoing per-state maintenance. You configure it once, and Usercentrics keeps the underlying requirements current as the regulatory landscape shifts.

What the MSPL Preset Actually Does

Once applied, the MSPL preset puts three core mechanisms in place for your site:

An opt-out for the sale and sharing of personal information

Visitors get a mechanism labeled "Do Not Sell or Share My Personal Information," letting them opt out of both.

Global Privacy Control (GPC) honoring

Cookiebot CMP monitors for the GPC signal in a visitor's browser and automatically applies the opt-out when it is enabled, so visitors do not have to set their preference on every site individually.

Double opt-in

Visitors who have opted out, whether directly or through GPC, can manually opt back in at any time.

MSPL or a State-Specific Preset: Which Should You Choose?

Both are valid starting points. The right one depends on how much control you need over individual states.

You can also combine the two: set up multiple domain groups and use coexisting configurations to serve a different banner depending on visitor location, if some states need tailored treatment while the rest run on MSPL.

How to Set Up MSPL in the Cookiebot CMP Admin Interface

Setup takes only a few clicks, whether you are configuring Cookiebot™ for the first time or adding MSPL to an existing account.

First-Time Setup

If you are setting up Cookiebot™ for the first time, select the MSPL preset during onboarding. This configures your banner to align with U.S. state privacy law requirements, and you can adjust it further at any time.

Adding MSPL to an Existing Account

1. Go to Domains & Aliases and open Manage your domain groups (or click Manage if you already have multiple groups).
2. Click + Create Group.
3. Name the new group MSPL and click Create group.
4. Click the Configure CMP icon on the right in the new group.
5. Open Legislation presets at the top right of the screen, find MSPL, and click Apply preset.
6. Click Save changes. Your MSPL domain group is now active.

If you want visitors to see a banner and be offered the "Do Not Sell or Share My Personal Information" choice, mark the Display banner checkbox in the group settings. Leaving it unmarked means no banner is shown and tracking runs by default, so review this setting against your own compliance obligations before publishing.

Consult Qualified Legal Counsel

MSPL configures the technical mechanisms most U.S. state privacy laws require on a website, including opt-out choices, GPC honoring, and a way to withdraw consent. It does not cover every obligation those laws place on a business, such as your privacy policy content or internal data handling practices.

Consult qualified legal counsel about your specific business operations, data privacy obligations, and compliance initiatives and settings. Treat this guide, and the MSPL preset itself, as one part of a broader compliance program, not a substitute for legal advice.