US CCPA Do not sell or share

The CCPA gives a consumer the right to direct a business to stop selling or sharing their personal information. "Sell" means disclosing a consumer's personal information to a third party for monetary or other valuable consideration. "Share" is narrower and specific to advertising: it means disclosing personal information to a third party for cross-context behavioral advertising, whether or not any money changes hands. A common example of sharing is letting an ad-tech vendor use a site visitor's identifiers to target ads across other sites and apps.

In practice, a business that sells or shares personal information must give consumers a clear way to opt out, most commonly a "Do Not Sell or Share My Personal Information" link, and must treat an opt-out preference signal such as Global Privacy Control as a valid opt-out request. Once a consumer opts out, the business must stop selling or sharing that person's personal information and must notify third parties that received the information during the interval between the request and compliance, directing them to honor and forward the opt-out. A consumer can also authorize someone else to opt out on their behalf.

Create a recipient-by-recipient disclosure map. Record the personal information, purpose, consideration, use for cross-context behavioral advertising, recipient role, contract, onward disclosures, and whether an exception to sale or sharing applies.

A service-provider or contractor label is not enough. The recipient's actual use and written contract must satisfy the CCPA restrictions. A disclosure can be sharing without money, and a disclosure for valuable consideration can be a sale even when it is not advertising.

A business that sells or shares personal information must offer two or more designated opt-out methods, with at least one reflecting how it primarily interacts with consumers. An online business must support a qualifying opt-out preference signal and at least one regulatory method, subject to the frictionless-processing alternative.

Do not require identity verification or account creation. Collect only information needed to complete the opt-out. A signal applies to the browser or device and associated profiles; when the consumer is known, it also applies to the consumer, including the known account and applicable offline sale or sharing.

The frictionless alternative is a conditional exception to posting the opt-out link, not to honoring requests. Under section 7025(f)-(g), the business must not charge for the signal, change the product or service experience, or display notification, pop-up, text, graphic, animation, sound, video, or interstitial content in response to it, subject to the specified permitted status display and privacy-settings link. Its privacy policy must describe the right, frictionless processing, how to send a signal, and other request methods. The signal must fully effectuate the opt-out: if unmatched offline sales require extra information, the link exception is unavailable.

Stop selling or sharing as soon as feasibly possible and no later than 15 business days after receipt. Notify every third party that received the consumer's personal information between receipt and compliance; direct it to honor the request and forward it to anyone to whom it made the information available during that interval.

Provide a way for the consumer to confirm that the request was processed. Except where the regulations allow otherwise, wait at least 12 months before asking the consumer to consent again. Keep financial-incentive conflicts and business-specific consent paths within the regulatory conditions.

Keep the disclosure classification, notice, interface, GPC tests, request log, suppression evidence, recipient notices, exceptions, and re-consent date together.

Reopen the analysis when a tag, SDK, recipient, purpose, consideration, contract, identity graph, or advertising use changes.