We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSDo not sell or share

US CCPA Do not sell or share

Consumers can direct a business to stop selling or personal information; a business must provide the applicable opt-out method and honor qualifying preference signals without unnecessary friction.

For privacy, product, advertising, engineering, and vendor teams implementing -and- choices.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

A California consumer can direct a business not to sell or share the consumer's personal information. "Sell" covers transfers to a third party for money or other valuable consideration. "Share" covers transfers to a third party for cross-context behavioral advertising, whether or not money changes hands. Statutory exclusions and properly structured service-provider or contractor relationships can change the result.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

How should a business classify transfers and honor opt-outs?

Inventory each disclosure by recipient, data category, purpose, consideration, advertising context, contract, and actual recipient use. A vendor label does not decide the analysis. A service provider or contractor must meet the statutory definition and written-contract restrictions; otherwise the recipient may be a third party.

A business that sells or shares must provide two or more designated opt-out methods suited to how it interacts with consumers. For online collection, those methods include processing a qualifying and providing an interactive form through the required link, alternative link, or privacy policy. A business may omit the link only if it meets every condition for frictionless signal processing; posting a cookie banner alone is not an opt-out method.

The request applies without identity verification, although the business may ask for information reasonably necessary to complete it. Stop covered transfers as soon as feasibly possible and no later than 15 business days, give the consumer a way to confirm completion, notify affected downstream third parties as required, use request data only to comply, and wait at least 12 months before asking the consumer to authorize or again, subject to the regulations.

  • Map browser, app, account, offline, advertising, analytics, and vendor transfers separately.
  • Classify each recipient as a third party, service provider, or contractor from the facts and contract.
  • Offer the required link or compliant alternative and honor Global Privacy Control and other qualifying signals.
  • Propagate the opt-out to tags, audiences, application programming interfaces (APIs), data warehouses, and downstream recipients that can sell or share.
  • Retest after changes to consent tools, advertising partners, identity resolution, or data flows.
Question 2

What evidence shows that covered transfers stopped?

Keep transaction-level scope evidence and end-to-end opt-out test results. A homepage link does not prove that advertising tags, server-side transfers, offline systems, and known accounts stopped the covered activity.

  • Transfer inventory with recipient, purpose, consideration, advertising use, role, contract, and classification rationale.
  • Screenshots and versioned copy for the notice, privacy policy, and opt-out link or alternative.
  • Tests showing link and preference-signal requests reach browser, device, known account, offline, and downstream systems as applicable.
  • Request timestamps, completion status, propagation logs, exceptions, failures, remediation, and the date on which re-consent may first be requested.
Question 3

Which scope and implementation mistakes defeat an opt-out?

Scope errors usually come from classifying a transfer by vendor name or payment method instead of the recipient, purpose, consideration, advertising context, contract, and actual use.

  • Assuming there is no because no money changes hands, while ignoring other valuable consideration.
  • Ignoring because an advertising transfer is unpaid.
  • Treating every analytics or advertising vendor as a service provider without checking the contract and actual use.
  • Stopping client-side tags but leaving server-side, audience, account, or offline transfers active.
  • Requiring identity verification, account creation, or unnecessary fields before accepting an opt-out.
Question 4

Questions and answers

Does a CCPA business need a Do Not Sell or Share link?

A business that sells or shares personal information generally must provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link, an approved alternative link, or the privacy-policy route allowed for a business that processes opt-out preference signals in a fully frictionless manner. The business must still honor qualifying preference signals. A cookie banner by itself is not an acceptable -or- opt-out method.

How quickly must a business honor a CCPA -or- opt-out?

A business must stop selling or the consumer's personal information as soon as feasibly possible and no later than 15 business days after receiving the request. The 15-day period is an outside limit, not a default delay: an advertising system that can stop the transfer immediately must do so immediately. The business must also notify affected downstream third parties as the regulations require and provide a way for the consumer to confirm that the request was processed.

Recommended next step

Turn US CCPA Do not sell or share into assigned work

Connect each sale or sharing decision to the opt-out interface, preference signal, downstream propagation, and test evidence.

Assessment workflow
Open Assessment Autopilot for US CCPA

Turn Do not sell or share into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CCPA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

California Privacy Protection Agency FAQ
cppa.ca.gov3 citations
Referenced sections
  • Plain-language consumer guidance on sale, sharing, opt-out methods, and preference signals.
  • Plain-language explanation of the sale and sharing opt-out and qualifying preference signals.
  • Consumer-facing explanation of the opt-out right.
CPPA CCPA Regulations effective January 1, 2026
cppa.ca.gov3 citations
Referenced sections
  • Current regulatory procedures for sale and sharing opt-outs.
  • Sections 7025 and 7026 govern preference signals and requests to opt out of sale or sharing.
  • Binding operational requirements for opt-out requests, signals, account scope, confirmation, and downstream notification.
California Civil Code section 1798.140
leginfo.legislature.ca.gov2 citations
Referenced sections
  • Binding definitions of sale, sharing, third party, service provider, and contractor.
  • Controls the classification of sale, sharing, recipients, and statutory roles.

Related guides

California Data Brokers: CCPA, Registration, and DROP Duties

Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.

CCPA Dark Patterns: Rules, Examples, and Review Checklist

Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.

CCPA Financial Incentives: Notice, Consent, and Data Value

Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.

CCPA Global Privacy Control (GPC): team obligations and technical implementation

Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.

CCPA Minors: Opt-In Rules for Consumers Under 16

Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.

CCPA Notice at Collection: Timing, Content, and Examples

Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.

Show all related guides (44)

CCPA Personal and Sensitive Information Categories

Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.

Does the CCPA apply to my business? Threshold guide

Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.

What must a CCPA privacy policy include?

A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.

What must CCPA service-provider contracts include?

Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.

What should teams do about consumer request verification under the CCPA?

Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.

When does the CCPA require risk assessments or cyber audits?

CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.

CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence

Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.

CCPA Contract Classification: Service Provider or Third Party?

Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.

CCPA Deadlines and Compliance Calendar

Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.

CCPA Do Not Sell or Share Guide

Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.

CCPA Do Not Sell or Share: Implementation and Testing

Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.

CCPA DSAR Workflow: Intake, Verification, and Response

Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.

CCPA Opt-Out Signal Workflow: Detect, Apply, and Test GPC

Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.

CCPA Penalties and Fines: Current Amounts

See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.

CCPA Privacy Policy Template: Required Content and Review

Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.

CCPA Risk Assessments, Cybersecurity Audits, and ADMT

Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.

CCPA vs CPRA: What Changed and Which Rules Apply

Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.

CCPA vs GDPR: Scope, Rights, Duties, and Evidence

Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.

US CCPA Applicability Test Guide

Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.

US CCPA Compliance Checklist

A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.

US CCPA Compliance Guide

Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.

US CCPA Dark Patterns Guide

Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.

US CCPA Data Broker Crossover Guide

Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.

US CCPA DSAR Verification Guide

Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.

US CCPA Enforcement and Penalties Guide

Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.

US CCPA Financial Incentives Guide

Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.

US CCPA GPC Signal Guide

Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.

US CCPA Minors Guide

Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.

US CCPA Notice at collection Guide

Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.

US CCPA Personal and Sensitive PI Categories Guide

Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.

US CCPA Privacy Law FAQ

Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.

US CCPA Privacy Notices and Disclosures Guide

Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.

US CCPA Privacy Policy Guide

Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.

US CCPA Requirements Guide

Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.

US CCPA Scope and Thresholds Guide

CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.

US CCPA Service Provider Contractor and Third Party Contracts Guide

Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.

US CCPA Service Provider Contractor Contracts Guide

Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.

US CCPA Thresholds Guide

Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.