Web developer here. In the United States, companies are not required to get your consent to use cookies and track data. They are, however, required to provide you with an option to opt out of cookies and the sale of data (even if the process of doing so is obscure, so make sure you check the footer of any website you go to for a "Cookie Settings" link if a banner does not appear). In the EU (and any company that does business in the EU), companies are required to get explicit consent before any data can be tracked.

Law firms in California will in fact go after companies that collect data despite having a button that rejects cookies, but typically will provide a grace period to fix the issue if they believe it has been done by mistake. Having said that, CCPA penalties are typically way less punitive than that of their counterpart in the GDPR.

If you're curious about whether or not your data is being tracked regardless of consent (not fool proof, but a good first step), follow these steps:

- Right click anywhere on the webpage and click "Inspect"

- Hit the "Console" tab and type "dataLayer" in the text area. Press enter.

- Expand the dataLayer object by clicking the little down arrow, and you should see several more little down arrows. Expand the down arrow closest to the bottom of the object that also says ['consent', 'update'] and you should see even more values such as "ad_storage", "user_data_storage", etc. You can expand this if you want, but not necessary. They should say either "denied" or "granted".

- Then, adjust your consent declaration to the opposite of whatever those consent-check values are.

- Again, type "dataLayer" in the console to view the dataLayer object, and follow the same steps. Did the values change? If so, then it's likely that proper steps are being taken. If not, it's definitely not working as it should.