The obligation attaches through the rules applying to your visitors rather than through your own location. European rules require consent before non essential cookies are placed, which is why the banners exist. California rules approach it differently, focusing on disclosure and a right to opt out of sharing, where sharing includes some ordinary advertising arrangements. A Las Vegas business with a public site can plausibly have visitors covered by either, and the cost of a policy is an afternoon.
The distinction that determines what you must do is between essential and non essential. Cookies required for the site to function, such as keeping somebody logged in or holding a cart, are essential and do not require consent. Analytics, advertising, and anything measuring behaviour are not, and those are the ones consent rules apply to. Most small business sites carry more of the second category than the owner realises, because tools were added over time.
Start by finding out what you actually set, which almost nobody does before writing a policy. Browser developer tools will list them, and free scanners will produce an inventory. Businesses routinely discover cookies from a tool they stopped using, a video embed, or a chat widget added and forgotten, each of which needs either disclosure or removal.
If you deploy a consent banner, make it honest rather than performative. A banner where the only option is to accept, or where declining is buried behind additional clicks, does not satisfy the rules it was installed to satisfy and creates a record of consent that would not withstand scrutiny. Decline should be as easy as accept, and nothing non essential should load before a choice is made.
This is general information rather than legal advice. The proportionate approach for a first year business is to inventory what you set, remove what you do not use, publish a plain policy describing the rest, and implement a genuine consent mechanism if you serve visitors in jurisdictions that require one.
Revisit it whenever you add a tool rather than annually, since that is when it becomes inaccurate. A chat widget, a video embed, a booking tool, or a new advertising pixel each set their own cookies, and a policy written before they existed no longer describes what your site does. Adding one line at the moment you install something takes seconds, and it is the only version of this that stays current without a scheduled audit nobody performs.