US CCPA Do Not Sell Share Implementation

Provide two or more designated methods suited to how the business interacts with consumers. An online business must accept a qualifying opt-out preference signal and at least one additional route: an interactive form linked from "Do Not Sell or Share My Personal Information," the Alternative Opt-out Link, or the privacy policy when the business satisfies every condition for frictionless signal processing. The form must let the consumer opt out of all sale and sharing even if it also offers narrower choices. A cookie banner or cookie control is not enough by itself because it may address collection rather than sale or sharing.

Stop sale or sharing as soon as feasibly possible and no later than 15 business days. If a third party received the consumer's personal information after the request arrived but before compliance, notify that third party, direct it to comply, and require it to forward the request to another person to whom it made the information available during that period. The rule does not require a notice to every historical recipient regardless of timing.

Inventory every transfer of personal information to another person and record the recipient, consideration, purpose, consumer context, and contract. Sale can involve money or other valuable consideration. Sharing covers making personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands. A recipient providing cross-context behavioral advertising is a third party for that service.

Test statutory exclusions separately. A consumer-directed disclosure requires an intentional direction or interaction; a qualifying merger or acquisition transfer remains subject to consistency and notice limits; and an identifier may be sent to communicate an opt-out or limit request. Removing money from a transaction does not avoid sale when the recipient still provides something of value or use.

Do not assume a tag is outside the opt-out because it is called analytics, measurement, or a service provider. Test the recipient's actual use and the section 7051 contract. If the relationship does not meet the service-provider or contractor rules, assess sale or sharing and connect the flow to the opt-out.

Assign an accountable product or engineering owner who can stop the data flow, a privacy owner who controls the legal classification and request logic, and procurement or legal owners for recipient contracts. Marketing and analytics teams should confirm business purposes and destinations; they should not approve their own role classifications without privacy review.

Evidence should connect a test request to the resulting technical state. Keep the request time and method, browser or device scope, profile and account matches, suppression state, network or event evidence, downstream notices, consumer confirmation, privacy-policy disclosure, exception analysis, and remediation.

A signal that conflicts with a business-specific setting allowing sale or sharing still controls unless the consumer later gives compliant consent. A financial-incentive conflict follows the separate section 7025 branch. A business cannot treat a later absence of the signal as consent for a known consumer who previously sent one.

Consumers under 16 have opt-in rules for sale or sharing: a consumer aged 13 to 15 may authorize the practice, while a parent or guardian must authorize it for a child under 13. Actual knowledge and willful disregard of age control the statutory branch. Sensitive personal information has a distinct right to limit, with statutory and regulatory exceptions. These controls may share an interface, but the workflow should preserve the different trigger, choice, and legal effect.

Test from the consumer action to the last covered recipient. Use both interface requests and qualifying opt-out preference signals. Test before consent state exists, after identifiers are assigned, while logged in, after logout, on another device for a known account, and against online and offline transfers. A successful interface state is not enough if network requests, server events, exports, or recipient-side use continue.

Re-run the test when tags, SDKs, destinations, identity graphs, consent tools, account logic, contracts, data uses, or privacy text change. Record failures as control defects with the affected flow, interim block, owner, due date, retest, and closure evidence.