Right to Opt-Out

The CCPA gives consumers the right to direct businesses not to sell their personal information to third parties.

Right to Opt-Out Illustration

What is the Right to Opt-Out?

The California Consumer Privacy Act (CCPA) gives consumers the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer's personal information. This is commonly referred to as the "right to opt-out."

Definition of "Sale"

Under the CCPA, "sell," "selling," "sale," or "sold" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.

"Do Not Sell My Personal Information" Link

Businesses that sell personal information must provide a clear and conspicuous link on their website homepage titled "Do Not Sell My Personal Information." This link should direct consumers to a webpage that enables them to opt-out of the sale of their personal information.

Do Not Sell My Personal Information

Example of a website homepage with the required link

Opt-Out Process

Businesses must:

1

Provide a Clear Link

Include a clear and conspicuous "Do Not Sell My Personal Information" link on their website

2

Include in Privacy Policy

Include a description of the consumer's right to opt-out in their privacy policy

3

Train Personnel

Ensure that individuals responsible for handling consumer inquiries are informed of the requirements regarding the right to opt-out

4

Process Requests Promptly

Process opt-out requests within 15 business days

5

Respect the Decision

Respect the consumer's decision to opt-out for at least 12 months before requesting authorization to sell personal information again

Opt-Out for Minors

The CCPA provides special protections for minors:

Under 16 Years

Businesses cannot sell the personal information of consumers under 16 years of age without affirmative authorization ("opt-in")

Ages 13-16

For consumers between 13 and 16 years of age, the consumer must affirmatively authorize the sale of their personal information

Under 13 Years

For consumers under 13 years of age, the parent or guardian must affirmatively authorize the sale of the child's personal information

Global Privacy Control (GPC)

The California Attorney General has clarified that businesses must honor the Global Privacy Control (GPC) signal as a valid opt-out request. The GPC is a browser setting that signals a consumer's choice to opt-out of the sale of their personal information to all websites they visit.

Important: Businesses must treat a GPC signal as a legally valid request to opt-out of the sale of personal information.

How to Enable GPC

  • Install a GPC-supported browser extension
  • Use a browser with built-in GPC support
  • Enable the GPC setting in your privacy preferences