US CCPA Do not sell or share

Inventory each disclosure by recipient, data category, purpose, consideration, advertising context, contract, and actual recipient use. A vendor label does not decide the analysis. A service provider or contractor must meet the statutory definition and written-contract restrictions; otherwise the recipient may be a third party.

A business that sells or shares must provide two or more designated opt-out methods suited to how it interacts with consumers. For online collection, those methods include processing a qualifying opt-out preference signal and providing an interactive form through the required link, alternative link, or privacy policy. A business may omit the link only if it meets every condition for frictionless signal processing; posting a cookie banner alone is not an opt-out method.

The request applies without identity verification, although the business may ask for information reasonably necessary to complete it. Stop covered transfers as soon as feasibly possible and no later than 15 business days, give the consumer a way to confirm completion, notify affected downstream third parties as required, use request data only to comply, and wait at least 12 months before asking the consumer to authorize sale or sharing again, subject to the regulations.

Keep transaction-level scope evidence and end-to-end opt-out test results. A homepage link does not prove that advertising tags, server-side transfers, offline systems, and known accounts stopped the covered activity.

Scope errors usually come from classifying a transfer by vendor name or payment method instead of the recipient, purpose, consideration, advertising context, contract, and actual use.