CCPA Opt-Out Rights: Do Not Sell or Share My Personal Information (2026)

Under the California Consumer Privacy Act (CCPA), California residents have the right to tell businesses to stop selling or sharing their personal information. This opt-out right is one of the law's most powerful consumer protections, and the CPRA amendments (effective January 1, 2023) significantly expanded its scope. Businesses that sell or share personal information for cross-context behavioral advertising must honor opt-out requests and provide clear mechanisms for consumers to exercise this right.

The California Attorney General and the California Privacy Protection Agency (CPPA) actively enforce opt-out requirements, with settlements reaching into the millions of dollars for noncompliance.

The Right to Opt Out of Sale

The original CCPA (effective January 1, 2020) gave consumers the right to direct a business to stop selling their personal information. Under Cal. Civ. Code 1798.120, a business that sells personal information to third parties must stop doing so once it receives a valid opt-out request.

What Counts as a "Sale"

The CCPA defines "sale" broadly. It covers selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to another business or third party for monetary or other valuable consideration.

"Other valuable consideration" is the key phrase. A business does not need to receive cash for a data transfer to qualify as a sale. If a business provides personal information to a third party and receives any benefit in return (discounts, services, analytics, enhanced functionality), that transfer may constitute a sale under the CCPA.

Exceptions to the Sale Definition

Not every data transfer is a sale. The CCPA excludes:

• Transfers to service providers or contractors under compliant written agreements
• Transfers at the consumer's direction (e.g., the consumer asks the business to share their data)
• Transfers to a third party as part of a merger, acquisition, or similar transaction

Publicly available information is sometimes described as a fourth exception to "sale." It is not. Under Cal. Civ. Code 1798.140(v)(2), publicly available information is carved out of the definition of "personal information" altogether, covering information lawfully made available from federal, state, or local government records and information a business reasonably believes the consumer lawfully made available to the general public or that is available from widely distributed media. The practical result is similar, but the mechanism matters: that information falls outside what the CCPA protects in the first place, so the opt-out right never attaches to it.

The Right to Opt Out of Sharing

The CPRA expanded opt-out rights beyond "sale" to include "sharing." Under the amended statute, sharing means making a consumer's personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands.

Why "Sharing" Was Added

Before the CPRA, many businesses argued that their data transfers to advertising technology companies were not "sales" because no direct monetary payment occurred. A business might provide user data to an ad network in exchange for targeted advertising services rather than cash. Under the original CCPA, this created a loophole: consumers could not opt out of data transfers that drove the very targeted ads they wanted to avoid.

The CPRA closed this gap. By defining "sharing" as a separate concept covering data transfers for cross-context behavioral advertising, the law captures virtually all common online advertising data flows, regardless of the form of consideration.

Cross-Context Behavioral Advertising

Cross-context behavioral advertising means targeting advertisements to a consumer based on personal information obtained from the consumer's activity across businesses, distinctly branded websites, applications, or services other than the one the consumer is currently interacting with.

In practical terms, this covers:

• Third-party tracking cookies that follow a consumer from site to site to build advertising profiles
• Data sharing with ad networks that use behavioral data to serve targeted ads across different platforms
• Retargeting based on a consumer's browsing history across multiple businesses' websites
• Data clean room arrangements where businesses pool consumer data for advertising purposes

How Consumers Can Opt Out

The CCPA provides multiple mechanisms for consumers to exercise their opt-out rights.

The "Do Not Sell or Share" Link

Every business that sells or shares personal information must post a clear, conspicuous link on its website homepage. The CPPA regulations specify that this link must be:

• Titled: "Do Not Sell or Share My Personal Information" (the CPRA updated the language from the original "Do Not Sell My Personal Information")
• Conspicuous: Easy to find without scrolling extensively or navigating through multiple pages
• Functional: Leads to a page or mechanism where the consumer can actually submit an opt-out request
• Account-free: The business cannot require consumers to create an account to opt out

The opt-out mechanism should be straightforward. The consumer submits the request, and the business must act on it. Unlike requests to know or delete, opt-out requests do not require identity verification, though the business may ask basic questions to identify which personal information is associated with the consumer.

Opt-Out Preference Signals

The CPRA codified the requirement that businesses must honor technology-based opt-out signals sent by consumers' browsers or devices. The CPPA regulations define an "opt-out preference signal" as a signal sent by a platform, technology, or mechanism on behalf of the consumer that communicates the consumer's choice to opt out of the sale and sharing of personal information.

Businesses must treat these signals as valid opt-out requests without requiring any additional action from the consumer.

Global Privacy Control (GPC)

Global Privacy Control is the most widely recognized opt-out preference signal. GPC is available as:

• A built-in browser feature in Mozilla Firefox, DuckDuckGo, and Brave
• A browser extension for Chrome, Edge, and other browsers
• A setting in certain privacy-focused mobile apps

When enabled, GPC sends a Sec-GPC: 1 HTTP header with every web request. Businesses that receive this signal must treat it as a request to opt out of the sale and sharing of personal information associated with that browser or device.

GPC Enforcement History

The California Attorney General has made GPC enforcement a priority:

• Sephora (2022): Settled for $1.2 million partly for failing to process GPC opt-out signals. This was the first major enforcement action specifically targeting GPC noncompliance.
• Disney (2026): Settled for $2.75 million, the largest CCPA settlement in California history, after investigators found the company's opt-out processes did not fully stop data sale and sharing even when consumers were logged into their accounts.
• Joint Investigative Sweep (2025): The CPPA, along with Colorado and Connecticut regulators, launched a coordinated investigation into businesses refusing to honor consumer opt-out requests, including GPC signals.

Alternative Opt-Out Link

Any business may elect, at its own discretion, to post one combined link in place of the two separate "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links. Cal. Civ. Code 1798.135(a)(3) offers this option to every business; it is not conditioned on how the business handles opt-out preference signals. The CPPA regulations require the alternative link to be titled "Your Privacy Choices" or "Your California Privacy Choices," to display the official opt-out icon next to that title, to sit in the header or footer of the homepage, and to lead to a page where the consumer can exercise both the opt-out right and the right to limit.

Processing opt-out preference signals is a separate provision, not a prerequisite. Under Cal. Civ. Code 1798.135(b)(1), a business that lets consumers opt out of sale and sharing and limit the use of sensitive personal information through an opt-out preference signal is not required to post the homepage links at all.

The Right to Limit Use of Sensitive Personal Information

The CPRA introduced a related but distinct right: the right to limit a business's use and disclosure of sensitive personal information. While the opt-out right covers sale and sharing, the limitation right restricts how a business uses certain highly sensitive data categories internally.

What Is Sensitive Personal Information?

Under the CCPA (as amended by the CPRA), sensitive personal information includes:

• Social Security, driver's license, state ID, or passport numbers
• Account login credentials combined with required security codes or passwords
• Precise geolocation data
• Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
• Contents of mail, email, and text messages (when the business is not the intended recipient)
• Genetic data
• Biometric data used to uniquely identify a consumer
• Health information, sex life, or sexual orientation data
• Neural data (added by SB 1223, effective 2025)

How the Limitation Right Works

When a consumer exercises this right, the business must limit its use of sensitive personal information to what is "reasonably necessary and proportionate" to perform the services or provide the goods the consumer requested. Specifically, the business can only use the sensitive data for:

• Performing the service or providing the goods the consumer expects
• Detecting security incidents and protecting against threats
• Resisting malicious, deceptive, or illegal activity
• Ensuring physical safety
• Short-term, transient use (such as displaying content, where the data is not used to build a profile)
• Performing services on behalf of the business (internal research, debugging, quality control)
• Verifying or maintaining the quality of a service or device

"Limit the Use of My Sensitive Personal Information" Link

Businesses that use or disclose sensitive personal information beyond the permissible purposes listed above must post a "Limit the Use of My Sensitive Personal Information" link on their homepage. This link functions similarly to the "Do Not Sell or Share" link but specifically addresses sensitive data use rather than sale or sharing.

Service Providers vs. Third Parties: Why It Matters for Opt-Out

Understanding the distinction between service providers, contractors, and third parties is critical for opt-out compliance because the CCPA treats data transfers to each category differently.

Service Providers and Contractors

When a business transfers personal information to a service provider or contractor under a compliant written agreement, that transfer is not a "sale" or "sharing." The data recipient is bound by contract to:

• Process the data only for the specific business purposes identified in the agreement
• Not sell or share the personal information
• Not combine it with personal information from other sources (except for limited purposes)
• Assist the business with consumer requests

Because these transfers are not sales or sharing, consumers' opt-out requests do not apply to them.

Third Parties

A "third party" under the CCPA is any entity that is not the business itself, a service provider, or a contractor. When personal information goes to a third party, the transfer is likely a sale or sharing, and the consumer's opt-out right applies.

Common third-party recipients include:

• Advertising technology companies that receive consumer data for targeted advertising
• Data brokers that aggregate and resell consumer information
• Social media platforms that receive consumer data for ad targeting or analytics
• Marketing partners that receive consumer data for cross-promotion

Practical Impact

A business that wants to avoid the "Do Not Sell or Share" requirement and opt-out obligations can restructure its data relationships. By ensuring that all data-receiving partners qualify as service providers or contractors under compliant written agreements, the business can argue that no "sale" or "sharing" occurs. The contracts must be genuine, with real restrictions on how the recipient uses the data.

The DELETE Act and DROP Platform

California took opt-out rights a step further with the Delete Act (SB 362), which created the Delete Request and Opt-Out Platform (DROP). Launched January 1, 2026, DROP allows consumers to:

• Send a single deletion request to all registered data brokers in California
• If a data broker cannot verify a deletion request, state law requires it to process the request as an opt-out of the sale and sharing of that consumer's personal information instead
• Receive ongoing deletion, with registered data brokers required to delete the consumer's personal information at least once every 45 days

Data brokers registered with the CPPA must participate in DROP. The platform simplifies what was previously a time-consuming process of submitting individual opt-out requests to potentially hundreds of data brokers.

The CPPA has already taken enforcement action against data brokers who fail to register, including fining a marketing firm in December 2025 for selling custom audiences without proper data broker registration.

What Happens After a Consumer Opts Out

Once a business receives a valid opt-out request (whether through the homepage link, a GPC signal, or the DROP platform):

1. Stop selling or sharing the consumer's personal information within 15 business days
2. Notify third parties that received the consumer's personal information through a sale or sharing after the request was submitted, direct them to comply with the request, and have them forward it to anyone they passed the data to during that window
3. Do not ask the consumer to re-consent for at least 12 months
4. Continue providing equal service (non-discrimination requirement)

After 12 months, a business may ask the consumer whether they would like to opt back in. The opt-in process must be affirmative and informed; the business cannot use dark patterns or misleading language to pressure the consumer.

Minors and Opt-In Requirements

For consumers under 16, the default is reversed, but the rule turns on what the business knows. Under Cal. Civ. Code 1798.120(c), a business may not sell or share a consumer's personal information if it has actual knowledge that the consumer is less than 16 years of age, unless the consumer (for consumers at least 13 and under 16) or the consumer's parent or guardian (for consumers under 13) has affirmatively authorized it. A business that willfully disregards a consumer's age is deemed to have had actual knowledge of it. Where that actual-knowledge standard is met, the business must obtain affirmative authorization before selling or sharing the minor's data, even without an opt-out request.

Penalties for Opt-Out Violations

Violations of opt-out requirements carry the same administrative penalties as other CCPA violations. As of the 2025 CPI adjustment:

Each individual whose opt-out right is violated can represent a separate violation. For businesses with millions of California consumers, penalties can accumulate rapidly.

The largest CCPA settlement to date, the $2.75 million Disney settlement, centered specifically on opt-out failures.

Related California Privacy Topics

• What Is CCPA? (comprehensive CCPA overview)
• CCPA vs CPRA: Key Differences Explained
• CCPA Compliance Checklist
• California Data Privacy Laws (parent hub)
• California Biometric Privacy Laws
• California Data Breach Notification Laws

This article provides general legal information, not legal advice. Opt-out requirements and enforcement interpretations continue to evolve. Consult an attorney for advice specific to your situation.

More California Laws

• California Deepfake Laws
• California Employee Monitoring Laws
• California GPS Tracking Laws
• California Recording Laws