← Back to Home

Right to Opt-Out

Right to Opt-Out Illustration

What is the Right to Opt-Out?

The California Consumer Privacy Act (CCPA) gives consumers the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer's personal information. This is commonly referred to as the "right to opt-out."

Definition of "Sale"

Under the CCPA, "sell," "selling," "sale," or "sold" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.

"Do Not Sell My Personal Information" Link

Businesses that sell personal information must provide a clear and conspicuous link on their website homepage titled "Do Not Sell My Personal Information." This link should direct consumers to a webpage that enables them to opt-out of the sale of their personal information.

Opt-Out Process

Businesses must:

  • Provide a clear and conspicuous "Do Not Sell My Personal Information" link on their website
  • Include a description of the consumer's right to opt-out in their privacy policy
  • Ensure that individuals responsible for handling consumer inquiries are informed of the requirements regarding the right to opt-out
  • Process opt-out requests within 15 business days
  • Respect the consumer's decision to opt-out for at least 12 months before requesting authorization to sell personal information again

Opt-Out for Minors

The CCPA provides special protections for minors:

  • Businesses cannot sell the personal information of consumers under 16 years of age without affirmative authorization ("opt-in")
  • For consumers between 13 and 16 years of age, the consumer must affirmatively authorize the sale of their personal information
  • For consumers under 13 years of age, the parent or guardian must affirmatively authorize the sale of the child's personal information

Global Privacy Control (GPC)

The California Attorney General has clarified that businesses must honor the Global Privacy Control (GPC) signal as a valid opt-out request. The GPC is a browser setting that signals a consumer's choice to opt-out of the sale of their personal information to all websites they visit.