“Do Not Sell My Personal Information” is an opt-out right that enables consumers to prevent businesses from selling their personal information. Several U.S. state privacy laws recognize this right, with different rules on eligibility and implementation.
In California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), extends this protection to sharing for cross-context behavioral advertising. Covered businesses that sell or share personal information must provide a “Do Not Sell or Share My Personal Information” link or satisfy the requirements for a permitted alternative, including the frictionless opt-out preference signal exception.
Under Section 1798.120 of the CCPA, a covered business must honor a California consumer’s request to opt out of the sale or sharing of their personal information. Amendments introduced by the California Privacy Rights Act (CPRA) extend this right to sharing for cross-context behavioral advertising, which is reflected in the broader wording “Do Not Sell or Share My Personal Information.”
Businesses that engage in these practices must disclose them, provide accessible opt-out methods, and apply consumers’ choices to the relevant data flows. A valid request must be implemented as soon as feasibly possible and no later than 15 business days after receipt. Displaying a link or describing the right in a privacy policy does not, by itself, fulfill these obligations.
Consumers must be able to submit an opt-out request directly through the designated mechanism without searching through unrelated policy text. The process should clearly explain the choice and make it easy to exercise.
Under the CCPA, personal information covers data that reveals who a consumer is or can reasonably be connected to that consumer or their household. It includes direct identifiers and information collected through online activity, such as:
Names, email addresses, and account identifiers.
IP addresses, cookie identifiers, and other online identifiers.
Browsing history, search history, and interactions with websites or advertisements.
Purchase records and inferences about preferences or interests.
An advertising identifier can qualify even when it does not contain a person’s name. The question is whether the information can reasonably be linked to a consumer or household.
Sensitive personal information is a particular category that includes precise geolocation, certain account-access credentials, health information, and biometric information processed to identify a consumer. The right to limit certain uses of sensitive information is separate from the right to opt out of sale or sharing. Simply collecting sensitive information does not automatically trigger a separate limitation link; the purpose and use matter.
Selling includes making personal information available to a third party in exchange for money or other valuable consideration. A business does not need to receive a direct payment for each record for a disclosure to qualify as a sale.
Sharing has a more specific meaning: disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands. This means targeting advertising using personal information obtained from a consumer’s activity across other businesses, distinctly branded websites, apps, or services beyond the business or service with which the consumer intentionally interacts.
Activity | How it should be assessed |
|---|---|
Providing customer information to a third party in exchange for payment | Can constitute a sale. |
Sending browsing identifiers to an advertising network for targeting across distinctly branded websites, apps, or services | Can constitute sharing, even without payment. |
Giving an order-fulfillment provider information needed to deliver a purchase | May fall within the service-provider or contractor exception when the legal, contractual, and use restrictions are met. |
Calling a vendor a “service provider” does not establish an exception by itself. Its actual use of the information and the required contract restrictions must support that role.
The CCPA generally covers for-profit businesses that do business in California, determine the purposes and means of processing consumers’ personal information, and meet at least one applicable threshold:
Annual gross revenue exceeding $26,625,000 in the preceding calendar year.
Annually buying, selling, or sharing personal information of 100,000 or more California consumers or households, alone or in combination.
Earning at least half of its annual revenue through the sale or sharing of consumers’ personal information.
The revenue amount reflects the inflation adjustment effective January 1, 2025, and remains current in 2026. Certain related entities and other statutory arrangements can also bring an organization within scope.
A business does not need a California office to be covered. However, receiving a visit from a California resident does not, by itself, establish that every website falls under the CCPA.
Assessing whether the law applies is the first step toward CCPA compliance. Businesses must then determine whether their activities constitute selling or sharing and implement the corresponding opt-out controls.
Covered businesses that sell or share personal information must offer at least two designated opt-out methods suited to how they interact with consumers. For online collection, businesses must honor qualifying opt-out preference signals and provide an interactive form through the “Do Not Sell or Share” link or the permitted alternative link. If a business meets the conditions for processing preference signals in a frictionless manner, the interactive form may instead be accessible through its privacy policy.
The CCPA regulations effective January 1, 2026, particularly Sections 7025 and 7026, establish several practical requirements:
Keep requests easy to submit: Use minimal steps and avoid confusing language or designs that steer consumers away from opting out.
Do not require an account or identity verification: Ask only for information necessary to apply the request. If no additional information is needed, process it without asking for more.
Act as soon as feasibly possible: The maximum is 15 business days, not a waiting period businesses can automatically use when they can act sooner.
Show that the request was processed: For example, display the saved opt-out status in the preference center.
Respect the continuing choice: Subject to regulatory exceptions, wait at least 12 months before asking the consumer to consent again. The opt-out does not automatically expire after 12 months. Resuming sale or sharing requires valid consumer consent; the applicable two-step opt-in process under Section 7028 requires the consumer to request the change and then separately confirm it.
Do not unlawfully discriminate: Businesses must not unlawfully discriminate against consumers for exercising their CCPA rights.
Consumers may also authorize an agent to submit an opt-out request on their behalf. The business may require the agent to provide the consumer’s signed written permission. This permission requirement does not apply to requests submitted through an opt-out preference signal.
Different rules apply when a business knows a consumer is under 16. Selling or sharing requires affirmative authorization: from the consumer for ages 13–15, or a parent or guardian for children under 13. A business that willfully disregards a consumer’s age is deemed to have actual knowledge of it.
Sometimes. Cookie-related data flows can qualify, depending on who receives the information and how it is used. Cookie identifiers, browsing activity, and device information may be personal information even when the visitor has not signed in.
For example, an online store may use an advertising pixel that sends browsing events and identifiers to a network for advertising across distinctly branded websites, apps, or services. Distinct branding matters; separate corporate ownership is not the only consideration. That activity can constitute sharing for cross-context behavioral advertising without the store selling a customer list or receiving a direct payment.
However, using cookies does not automatically mean a website sells or shares personal information. A shopping-cart cookie serves a different purpose from tracking cookies used to follow browsing activity across distinctly branded websites, apps, or services. Analytics tools also require assessment of their settings, contracts, and actual data use.
The review should cover pixels, SDKs, server-side transfers, and other tracking mechanisms as well as browser cookies. Turning off a cookie while continuing the same covered disclosure through another channel does not implement the opt-out.
Start with a cookie audit to identify cookies and tracking technologies, then map the information collected, its recipients, and its purposes. Then connect the opt-out interface to the systems responsible for covered sales and sharing.
Use a conspicuous link that opens the opt-out mechanism or its notice. Unless a permitted alternative applies, Section 7013 requires placement in the header or footer of the business’s homepage(s). “Homepage” includes the introductory page and pages collecting personal information. Where required, the notice at collection must also link to the opt-out.
Permitted alternatives include “Your Privacy Choices” or “Your California Privacy Choices” with the prescribed icon. Businesses may omit the separate link if they meet Section 7025(f)–(g)’s frictionless-processing and disclosure conditions. Detecting GPC alone is insufficient: the signal must fully implement the applicable opt-out, including relevant offline sales or sharing. The privacy policy must still contain the required opt-out notice.
For mobile apps, Section 7003 requires access through the privacy policy available from the platform or download page and within the app, such as its settings menu. For offline collection, provide an appropriate notice, such as a paper notice or prominent signage directing consumers to the online notice.
Explain the right clearly and provide a direct way to exercise it through a standalone page or preference center.
Use readable labels and accessible controls compatible with assistive technology and recognized standards such as WCAG. Avoid double negatives and unnecessary steps. Unless expressly permitted, the more protective choice must not require more time or effort than the less protective one. Section 7003 establishes the disclosure and accessibility requirements.
For example, a footer link can open a panel with an “Opt out of all sale and sharing” control and display “Opt-Out Request Honored” after processing. Optional category controls must not replace the complete opt-out option.
A cookie notice describing cookie use is insufficient by itself. The mechanism must specifically allow consumers to opt out of sale and sharing.
Apply the choice to advertising tags, pixels, integrations, and other covered disclosures. Saving a preference must change the corresponding data flows.
If information was sold or shared between receiving and implementing the request, notify the recipients and direct them to comply and forward the request as required.
Retain request and response records for at least 24 months, with reasonable security safeguards. Section 7101 restricts their use and prohibits third-party sharing except where necessary to meet a legal obligation.
Global Privacy Control (GPC) automatically communicates an opt-out preference through a supported browser or extension. Honor qualifying signals without requiring another submission. If GPC conflicts with a business setting permitting sale or sharing, process the opt-out unless the consumer subsequently gives valid consent. Financial incentive programs have separate conflict rules.
Apply the signal to the browser or device and associated profiles. For known consumers, include relevant account and offline information as required. A later visit without the signal does not automatically reverse the choice.
Display whether the signal was processed, using a message such as “Opt-Out Request Honored” and the corresponding preference status.
Explain which information is sold or shared, the relevant third-party categories, how consumers can exercise their rights, and how preference signals are processed.
Update required privacy-policy disclosures at least every 12 months and applicable notices when data practices change. Keep them consistent with actual practices, and reassess “we do not sell personal information” claims when advertising integrations introduce covered sales or sharing.
Check the complete journey after deployment and when tracking tools change:
The link opens the intended control without a login requirement.
The choice stops the relevant browser-side and server-side disclosures.
GPC is honored without requiring another opt-out submission.
The interface shows that the request was processed.
Returning visits respect the saved preference within its applicable scope.
Opting out restricts the sale and sharing of personal information; it does not block advertising altogether. Websites may continue displaying contextual ads based on the page being viewed. The choice prevents covered data practices, including sharing personal information for cross-context behavioral advertising.
CCPA generally uses an opt-out framework for the sale and sharing of personal information, rather than requiring prior consent for all nonessential cookies. Covered businesses must provide applicable notices and effective opt-out methods, including honoring qualifying preference signals. Selling or sharing information about consumers known to be under 16 requires affirmative authorization, with parental or guardian authorization required for children under 13.
CCPA protects California residents, while its obligations can extend to businesses located outside California that meet the law’s applicability requirements. Other states have separate privacy laws with their own thresholds and consumer rights. Applying California privacy settings nationwide does not, by itself, establish compliance with those laws.
Government agencies and nonprofit organizations generally fall outside CCPA’s definition of a covered business. Separate exemptions apply to specified information, including certain health information and data governed by particular financial or credit-reporting laws. Because many exemptions attach to the information rather than the entire organization, a business may still have CCPA obligations for its other data.
The California Privacy Protection Agency conducts administrative enforcement, and the California Attorney General also has enforcement authority. Since January 1, 2023, businesses have no longer had a general automatic 30-day cure period before regulatory enforcement. A separate notice-and-cure provision applies to certain private security-breach claims.
The inflation-adjusted amounts effective January 1, 2025, and current in 2026, allow administrative fines of up to $2,663 per violation or $7,988 per intentional violation and qualifying violations involving consumers known to be under 16. Qualifying private security-breach claims may support statutory damages of $107–$799 per consumer per incident, or actual damages if greater. These are separate remedies: an ordinary CCPA violation does not automatically create a private damages claim. The amounts are published in the CPPA’s official monetary thresholds.
CPRA amended and expanded CCPA, so the operative law continues to be called CCPA. Its principal consumer-rights amendments took effect on January 1, 2023, including the right to opt out of sharing for cross-context behavioral advertising and additional protections for sensitive personal information.
An opt-out request stops covered sales and sharing; deletion requires a separate request under a different CCPA right. Businesses must implement an opt-out as soon as feasibly possible and within 15 business days. Deletion requests generally require a substantive response within 45 calendar days, subject to a permitted extension and applicable retention exceptions.
A business may decline to apply an opt-out in limited circumstances, such as when it does not sell or share the information, the information is exempt, or it has a reasonable, documented, good-faith belief that the request is fraudulent. A fraud-based refusal must include an explanation. Identity verification cannot be made a condition of opting out, although a business may request the information necessary to identify and stop the relevant sales or sharing.
Türkçe
English
