The "Do Not Sell or Share" link
Published 16 min read
If your site sells or shares personal information, it needs the link in one of three lawful forms, and it must honour the browser’s opt-out signal whichever form it picks.
The link comes in three lawful forms
The link’s wording comes from California’s CCPA. A business that sells or shares personal information must give Californians a way to stop it from the homepage, and § 1798.135 allows three ways to do that. A label outside these three is not one the law offers.
Form A, § 1798.135(a)(1)–(2)
The two named links
site footer
- About
- Contact
- Privacy policy
- Do Not Sell or Share My Personal Information
- Limit the Use of My Sensitive Personal Information
The default. The second link is needed only where sensitive personal information is used beyond the purposes the law allows.
Form B, § 1798.135(a)(3); regs § 7015
The Alternative Opt-out Link
site footer
- About
- Contact
- Privacy policy
- Your Privacy Choicesopt-out icon
One link for both rights, titled “Your Privacy Choices” or “Your California Privacy Choices”, with the opt-out icon beside the title.
Form C, § 1798.135(b); regs § 7025(e)–(g)
No link: the signal, frictionless
site footer
- About
- Contact
- Privacy policy
- no opt-out link; the policy says signals are processed frictionlessly
Allowed only to a business that processes opt-out preference signals frictionlessly and meets every condition in § 7025(g). The opt-out notice moves into the privacy policy.
Cal. Civ. Code § 1798.135 and CCPA regulations §§ 7013, 7015, 7025 as posted by the CPPA, read 22 Oct 2026. The icon is drawn here as a labelled box; use the official file.
A form C business still processes the signal, and a form A or B business must process it too: posting a link never excuses ignoring an opt-out preference signal (regs § 7025(e)). A business that neither sells nor shares needs no link at all, provided its privacy policy says it does not sell or share (§ 7013(g)).
Do you sell or share? Read your tags, not your contracts
Most firms that need the link do not think of themselves as selling data. The CCPA reaches further than the everyday word. “Sell” covers making personal information available to a third party for money or other valuable consideration. “Share” covers making it available for cross-context behavioural advertising, paid or not: ads aimed at a person using what they did on other businesses’ sites, apps or services.
“A service provider or contractor cannot contract with a business to provide cross-context behavioral advertising.”
That sentence closes the usual escape route. A data processing agreement with an ad platform does not turn retargeting into a service: for cross-context behavioural advertising, the platform is a third party. Read each tag on your site against the rows below.
| What the tag or deal does | How the CCPA reads it | Why |
|---|---|---|
| A pixel or tag sends what visitors do on your site to an ad platform, which uses it to target them on other sites and apps | Sharing | Cross-context behavioural advertising, whether or not money changes hands. § 1798.140(ah)(1), (k) |
| Third-party trackers collect visitor data on your pages, and in return your own ads reach likelier customers | Sale, in the Attorney General's reading | “Other valuable consideration” is enough. The AG alleged exactly this arrangement against Sephora. § 1798.140(ad)(1) |
| An ad-tech firm that runs cross-context behavioural ads for you signs a service-provider contract | Still sharing | A service provider or contractor cannot contract to provide cross-context behavioural advertising; for that service it is a third party. Regs § 7050(b) |
| A hosting, email or analytics vendor processes data only for you, under a contract carrying the § 1798.140(ag) terms | Neither | A service provider collecting under the required written contract is not a sale or sharing. Regs § 7026(f)(1) |
| A visitor asks you to send their details to a partner, and you do | Not a sale | A consumer directing the business to disclose is carved out. § 1798.140(ad)(2)(A) |
Cal. Civ. Code § 1798.140 and CCPA regulations as posted by the CPPA; Sephora press release (oag.ca.gov); read 22 Oct 2026 | ||
The second row is not a hypothetical. In August 2022 the Attorney General settled with Sephora, alleging that letting third-party trackers on its site and app, in exchange for better targeting, was a sale under the CCPA, and that Sephora neither said it sold data nor let people opt out (AG press release). The plain-language background on both words is in what the CCPA is.
List every third-party tag that fires on your public pages and write next to each one who receives the data and what they may do with it. If any row reads “sale” or “sharing”, you need one of the three forms of the link, and the signal duty comes with it.
Which link does your site need?
Four answers decide it. The questions assume the firm is a “business” under the CCPA in the first place; if that is still open, run the CCPA threshold calculator first. Each line of the answer carries the section it comes from, so you can check it against the text.
Pre-filled for a typical small site running retargeting pixels. Change any answer; nothing leaves your browser.
What the site needs
Form A or form B, plus the signal
- 1.
“Do Not Sell or Share My Personal Information” in the header or footer of every homepage, or the Alternative Opt-out Link.
§ 1798.135(a); regs §§ 7013(c), 7015(b)
- 2.
A Notice of Right to Opt-out on the page the link opens, with the interactive form, unless the click itself opts the person out.
regs § 7013(a), (e)(1), (f)
- 3.
Responding to the signal with a banner, a fee or a different experience is not frictionless, so the no-link route (form C) is closed.
regs § 7025(f)
- 4.
Process opt-out preference signals such as GPC as a valid opt-out for that browser or device, and show on the site whether the signal was honoured.
regs § 7025(c)(1), (c)(6)
- 5.
Stop selling and sharing as soon as feasibly possible and no later than 15 business days after a request, and tell the third parties that received the data in between.
regs § 7026(f)
- 6.
Offer at least two opt-out methods, one of them the signal. A cookie banner or cookie controls alone is not an acceptable method.
regs § 7026(a)(1), (a)(4)
Information, not legal advice. Built from Cal. Civ. Code § 1798.135 and CCPA regulations §§ 7013–7015, 7025–7027 as posted by the CPPA, read 22 Oct 2026.
Where the link goes and how it must read
The rules are short and literal. The link sits in the header or footer of the business’s homepage (regs § 7013(c)), and “homepage” is wider than the front page: the statute defines it as the introductory page and any page where personal information is collected (§ 1798.140(p)). A sign-up form, a quote request or a checkout page is a homepage for this purpose.
It must look like a link people will find: at least the approximate font size and colour of the other links next to it (§ 7003(c)). A firm may run a separate homepage for Californians that carries the links instead, if it takes reasonable steps to send California visitors there (§ 1798.135(d)).
The icon, for the alternative link
The alternative link’s icon goes adjacent to the title, at roughly the size of the other icons in the header or footer, and its colours may be inverted or changed so it stays visible on the page background (§ 7015(b)(2)–(3)). The Attorney General’s office hosts the icon files on its opt-out icon page; that page still quotes the older regulation number and link title, so take the rule from § 7015 and only the file from the page.
In an app
For a mobile application the conspicuous link sits in the privacy policy, which must be reachable from the app’s platform or download page and from inside the app, for example its settings menu (§ 7003(d)).
| Label on the site | Against the rule | Why |
|---|---|---|
| Do Not Sell or Share My Personal Information | Meets the title rule | The statute's own words. § 1798.135(a)(1) |
| Your Privacy Choices, with the opt-out icon beside it | Meets the title rule | “Your California Privacy Choices” works too. Regs § 7015(b) |
| Do Not Sell My Personal Information | Out of date | The older title, still on the Attorney General's icon page. The statute now adds “or Share”. § 1798.135(a)(1) |
| Your Privacy Choices, no icon | Falls short | The alternative link must carry the icon adjacent to the title. Regs § 7015(b) |
| Cookie settings | Not by itself | A cookie banner or cookie controls is not an acceptable opt-out method on its own. Regs § 7026(a)(4) |
| The right title, in smaller grey type than the links beside it | Falls short | At least the approximate size and colour of the links next to it. Regs § 7003(c) |
| The right title on the front page only, not on the checkout or sign-up page | Check this | “Homepage” includes any page where personal information is collected. § 1798.140(p) |
Cal. Civ. Code § 1798.135, § 1798.140(p); CCPA regulations §§ 7003, 7015, 7026; read 22 Oct 2026 | ||
Open every page that has a form on it and look at the footer. If the link is missing on any of them, or smaller than its neighbours, fix the template, not the page. The cookie banner checklist covers the banner that usually sits beside it.
What has to happen after someone clicks
The link is the easy part. Regulators look at the path behind it, and that path differs from the rest of the CCPA request queue in one big way: a request to know or delete waits on identity checks; an opt-out may not.
- 01
The click lands
Either the click opts the person out at once, or it opens the Notice of Right to Opt-out: a plain description of the right and the interactive form to use it.
regs § 7013(a), (f)
- 02
Ask for almost nothing
No account, and no information beyond what is needed to stop the sale or sharing. No verifiable consumer request either: if the business can act without more detail, it must.
regs § 7026(c)–(d)
- 03
Keep the path short and even
Easy, with minimal steps, and no harder than saying yes. A louder “accept” button or an extra screen on the way out is not symmetrical.
regs §§ 7026(b), 7004
- 04
Accept agents
A person may act through an authorised agent with signed permission. Permission is never needed for a request sent by an opt-out preference signal.
regs § 7026(j)
- 05
Refuse only with a documented reason
A request may be denied only on a good-faith, reasonable and documented belief that it is fraudulent, and the requester is told why.
regs § 7026(e)
- 06
Stop, and pass it on
Stop selling and sharing, then notify every third party that received the data between the request and the stop, telling them to comply and forward it.
regs § 7026(f)(1)–(2)
- 07
Show it worked
Give the person a way to confirm the opt-out was processed, such as “Opt-Out Request Honored” or a toggle in their settings.
regs § 7026(g)
- 08
Leave them alone
Wait at least 12 months before asking the person to opt back in, and use what they gave you only to carry out the opt-out.
regs § 7026(k); § 1798.135(c)(6)
- 09
Keep the record
Log each request and how it was handled, and keep the log for at least 24 months.
regs § 7101(a)
Stop selling and sharing as soon as feasibly possible, and no later than 15 business days from the date the request arrives (regs § 7026(f)(1)). The regulation’s own example is a site selling through real-time bidding: it can stop at once, so it must, and may not take the 15 days.
For the rest of the CCPA request queue, the DSAR deadline calculator works out the dates for requests to know, delete and correct, which run on a different clock.
The link and Global Privacy Control: one never replaces the other
The statute appears to offer a choice: comply with the links in § 1798.135(a), or let people opt out through an opt-out preference signal under § 1798.135(b). The regulation reads that choice narrowly, and the reading matters more than anything else on this page.
“Even if the business posts the above-referenced links, the business must still process opt-out preference signals, though it may do so in a non-frictionless manner.”
So the real choice is between two routes that both process the signal. Either the business posts the links and still processes the signal, or it processes the signal frictionlessly and may leave the links off. The California Attorney General says the same of Global Privacy Control in particular: it must be honoured as a valid request to stop the sale or sharing (oag.ca.gov).
| Links + signal (forms A, B) | Frictionless signal (form C) | |
|---|---|---|
| The footer link | Required: form A or B | Optional |
| Opt-out preference signals such as GPC | Processed as a valid opt-out | Processed as a valid opt-out, frictionlessly |
| Responding to a signal | May point out a conflict with the person's own setting and ask for consent, under the § 7004 rules (§ 7025(c)(3)) | No notice, pop-up or interstitial; showing the opted-out status is allowed (§ 7025(f)(3)) |
| A fee or a different experience | A charge needs a Notice of Financial Incentive (§ 7026(i)) | Never (§ 7025(f)(1)–(2)) |
| The opt-out notice | On the page the link opens (§ 7013(e)(1)) | In the privacy policy, with the four § 7025(g)(2) statements |
| Offline selling or sharing | Covered by the form | Closes this route unless the signal alone stops it (§ 7025(g)(3)) |
CCPA regulations §§ 7013, 7025, 7026 as posted by the CPPA; read 22 Oct 2026 | ||
What frictionless means
Three things, all from § 7025(f): no fee or other valuable consideration for using the signal; the same experience of the product as someone without it; and no notification, pop-up, text, graphic, animation, sound, video or interstitial in response to it. Then § 7025(g) adds the conditions for dropping the link: the privacy policy must describe the right, say that signals are processed frictionlessly, explain how to turn a signal on, and list any other opt-out method; and the signal must be able to carry out the whole opt-out.
The regulation’s two examples draw the line. A business that shares browsing data online and also sells customer data offline cannot use the no-link route, because a browser signal cannot reach the offline sale without more information. A business that only sells and shares online can.
Two moves that close the no-link route
- Answering a signal with a menu of per-use opt-outs instead of a single full one (§ 7026(h)).
- Answering a signal by telling the person about a charge for the product or service (§ 7026(i)).
Confirm your browser sends the signal with the Global Privacy Control checker, then load your own site in it: the ad tags should stay silent and the site should show the opt-out as honoured. From 1 January 2027 a business that makes a browser must build in a setting that sends the signal (§ 1798.136), so expect more visitors to arrive with it on.
What the enforcement cases turned on
Neither case was about a missing word in a footer. One was about a business that did not see itself as selling; the other about the friction behind the link.
California Attorney General, settlement, 24 Aug 2022
Sephora
$1.2 million
- Did not tell consumers it was selling their personal information.
- Did not process opt-out requests sent through user-enabled global privacy controls.
- Did not cure within the 30-day period the CCPA then allowed.
The settlement made Sephora say plainly that it sells data and accept opt-outs through GPC. The same day the AG sent notices to other businesses over unprocessed signals.
The regulator’s announcementCPPA Board, decision (ordered 7 Mar 2025), announced 12 Mar 2025
American Honda Motor Co.
$632,500
- Required verification and excessive personal information for opt-out and limit requests.
- Ran a privacy tool that did not offer the choices in a symmetrical way.
- Made it hard for authorised agents to act for people.
- Shared data with ad tech companies without contracts carrying the required terms.
Honda agreed to a simpler request process, staff training, certification, and a review of its request methods by a UX designer. The path behind the link was the case.
The regulator’s announcementThese are allegations as the regulators described them, resolved by a settlement and by a Board decision. The fine amounts and the other published actions are in CCPA penalties.
Outside California: the signal travels further than the link
The link titles and the three forms on this page are California’s. For the other comprehensive state laws, the table this site keeps records whether each one makes a business honour an opt-out preference signal, and from when. It does not record link wording, so check a state’s own text before copying the California titles into it. On the signal, 9 of the 15 laws below carry the duty.
| State | Signal duty | From, and notes |
|---|---|---|
| Colorado | yes | 1 Jul 2024 (GPC is the only recognised mechanism) |
| Connecticut | yes | 1 Jan 2025 |
| Texas | yes | 1 Jan 2025 (authorized-agent technology, a browser setting included) |
| Montana | yes | 1 Jan 2025 |
| New Jersey | yes | 15 Jul 2025 (GPC named) |
| Minnesota | yes | 31 Jul 2025 |
| Maryland | optional | a signal is one method a controller may use beside a link (“on or before 1 Oct 2025”, § 14-4707(f)(3)); recognising signals other states approve counts as compliance (§ 14-4707(g)(2)) |
| Oregon | yes | 1 Jan 2026 (GPC named as an example) |
| Delaware | yes | 1 Jan 2026 |
| New Hampshire | yes | no separate start date given by the AG |
| Virginia | none | none in the chapter |
| Iowa | none | none in the chapter |
| Tennessee | none | none in the act as enacted |
| Indiana | none | none in the act as enacted |
| Nebraska | not verified | the statute could not be read |
State statutes and regulator pages as read for this site’s state table; read 22 Oct 2026 | ||
Thresholds, cure periods and enforcers for each law are in the US state privacy laws table.
Cheat sheet
- Who needs it
- A CCPA business that sells or shares personal information (§ 1798.135(a))
- Exact title
- “Do Not Sell or Share My Personal Information” (§ 1798.135(a)(1))
- Single-link option
- “Your Privacy Choices” or “Your California Privacy Choices”, icon beside it (regs § 7015(b))
- Where
- Header or footer of every homepage, incl. pages that collect personal information (§ 7013(c); § 1798.140(p))
- Look
- At least the approximate size and colour of neighbouring links (§ 7003(c))
- Signal
- Processed either way; only a frictionless business may drop the link (§ 7025(e)–(g))
- Verification
- Not allowed as a condition of opting out (§ 7026(d))
- Stop by
- No later than 15 business days (§ 7026(f)(1))
- Ask again
- Not for at least 12 months (§ 7026(k))
- Not selling
- No link; say so in the privacy policy (§ 7013(g))
CCPA statute and regulations as posted by the CPPA, read 22 Oct 2026. Information, not legal advice.
Questions
We only run Google Analytics and a Meta pixel. Do we need the link?
It turns on what the tags do with the data, not on the vendor’s name. A pixel that lets an ad platform target your visitors on other sites and apps is cross-context behavioural advertising, which is sharing, and a service-provider contract cannot change that (regs § 7050(b)). Analytics used only for you, under a contract with the service-provider terms, is neither. Read the tag settings, then the table above.
Can the link just open our cookie banner?
Not on its own. A cookie banner or cookie controls is not by itself an acceptable way to opt out of sale or sharing, because cookies concern collection, not sale or sharing (regs § 7026(a)(4)). The page behind the link has to let the person opt out of the sale and sharing itself. Our comparison of consent management platforms shows which ones run a “Do Not Sell or Share” link and honour GPC.
We honour GPC. Can we remove the link?
Only if you process the signal frictionlessly (no fee, no change in experience, no pop-up in response), your privacy policy carries the four statements in § 7025(g)(2), and the signal alone stops all of your selling and sharing, offline included. If you post the link, you must still process the signal (§ 7025(e)).
Can we ask for an email address or ID before opting someone out?
You may ask only for what you need to carry out the request, and may not require a verifiable consumer request or an account (regs § 7026(c)–(d)). If you can stop the sale or sharing without more detail, you must. Asking for verification is one of the things the CPPA alleged against Honda.
Is the link required if only a few of our visitors are in California?
The link duty attaches to a business covered by the CCPA, and coverage turns on the three thresholds, not on the share of visitors. A covered business may serve Californians a separate homepage that carries the links, if it takes reasonable steps to send them there (§ 1798.135(d)).
What must our privacy policy say about all this?
If you do not sell or share, that you do not. If you do, a description of the right to opt out and how to use it, with the link or, on the no-link route, the § 7025(g)(2) statements. The privacy policy checklist lists every CCPA item.