US CCPA Do not sell or share

Start with what the right means: "sell" is disclosing personal information to a third party for monetary or other valuable consideration, and "share" is disclosing it to a third party for cross-context behavioral advertising, with or without payment. A business that does either must let consumers opt out (usually a "Do Not Sell or Share My Personal Information" link), must honor an opt-out preference signal such as Global Privacy Control as a valid request, and must then stop selling or sharing that consumer's data.

Teams should then treat Do not sell or share as a source-linked operating decision: confirm whether the issue affects business-threshold status, notice at collection, privacy policy disclosures, consumer rights, do-not-sell/share controls, GPC, service-provider restrictions, or enforcement exposure, assign the team that can change the process, and keep evidence showing the action and review trigger.

The safest first step is to identify the collection point, consumer right, sale/share status, GPC signal, vendor role, and applicable threshold before assigning the CCPA action.

Useful evidence is not just a privacy policy. Keep the source, threshold notes, notice screenshots, request logs, opt-out/GPC tests, vendor terms, and approval trail together.

The common failure pattern is treating CCPA as one static notice instead of checking each collection point, sale/share flow, consumer request, GPC signal, and vendor restriction against current source material.