Can a business use a single opt-out link under the CCPA?

The two long link titles in the CCPA are unpopular for a reason. "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" are each longer than most homepage footers want, and together they take up more room than the rest of the legal links combined.

The statute anticipated this. Section 1798.135 contains two separate alternatives to the default, and most businesses are eligible for at least one of them.

The default: two links, exact titles

Section 1798.135(a) opens by identifying who is covered. A business that sells or shares consumers' personal information, or uses or discloses consumers' sensitive personal information for purposes other than those authorized by subdivision (a) of section 1798.121, shall, in a form that is reasonably accessible to consumers, do the following.

Paragraph (a)(1) requires a clear and conspicuous link on the business's internet homepages, titled "Do Not Sell or Share My Personal Information," to a web page that enables a consumer, or a person authorized by the consumer, to opt out of the sale or sharing of the consumer's personal information.

Paragraph (a)(2) requires a clear and conspicuous link on the homepages, titled "Limit the Use of My Sensitive Personal Information," enabling the consumer or an authorized person to limit the use or disclosure of sensitive personal information to the uses authorized by section 1798.121(a).

The titles are given in quotation marks in the statute, which is why paraphrases such as "Your Privacy Choices" do not satisfy paragraphs (1) and (2) on their own terms.

The first alternative: one combined link

Paragraph (a)(3) is the consolidation option, and it is written as a permission rather than a requirement:

At the business' discretion, utilize a single, clearly labeled link on the business' internet homepages, in lieu of complying with paragraphs (1) and (2), if that link easily allows a consumer to opt out of the sale or sharing of the consumer's personal information and to limit the use or disclosure of the consumer's sensitive personal information.

Three conditions travel with it. The link must be single and clearly labeled. It must sit on the homepages. And it must easily allow both actions.

That last condition is where consolidated links usually fail. A business that folds two duties into one link and then builds a destination page handling only the sale-and-sharing opt-out has not satisfied paragraph (a)(3), because the paragraph requires the link to reach both outcomes. The sensitive-information limit is a separate right under section 1798.121 and it has to be reachable from the same place.

Note also what paragraph (a)(3) does not do. It does not prescribe the label. The statute says "clearly labeled" and stops, which is a materially lighter requirement than the verbatim titles in (a)(1) and (a)(2).

The second alternative: honor the signal instead

Subdivision (b) is the larger exemption, and it removes the homepage links altogether.

Paragraph (b)(1) provides that a business shall not be required to comply with subdivision (a) if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer's consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations adopted pursuant to section 1798.185(a)(19), indicating the consumer's intent.

Paragraph (b)(3) settles the relationship between the two subdivisions: a business that complies with subdivision (a) is not required to comply with subdivision (b), and for the purposes of clarity, a business may elect whether to comply with subdivision (a) or subdivision (b).

So the choice is real and it is the business's to make. Honor a conforming opt-out preference signal across both the sale-and-sharing opt-out and the sensitive-information limit, and the homepage links are not required.

The same condition that trips up the single link applies here with more force. The signal route must cover both outcomes. A business honoring Global Privacy Control for sale and sharing alone has not met paragraph (b)(1), and still owes subdivision (a).

The consent-to-ignore page, and its conditions

Paragraph (b)(2) allows a business on the signal route to provide a link to a web page enabling the consumer to consent to the business ignoring the opt-out preference signal for that business's sale or sharing, or for additional uses of sensitive personal information. Three conditions attach.

Subparagraph (A) requires the consent page to allow the consumer, or a person authorized by them, to revoke the consent as easily as it is affirmatively provided.

Subparagraph (B) requires that the link not degrade the consumer's experience on the page they intended to visit, and that it have a similar look, feel, and size relative to other links on the same page.

Subparagraph (C) requires the consent page to comply with the technical specifications in the regulations adopted under section 1798.185(a)(19).

Subparagraph (B) is worth pausing on. It is written as a design constraint, and it rules out the pattern it was plainly aimed at: an oversized, high-contrast interstitial asking the consumer to reverse a choice they already made through their browser.

Choosing between the routes

For a business that already has a functioning preference-signal implementation, subdivision (b) is the cheaper standing obligation: no homepage links to maintain, and no titles to get exactly right.

For a business that does not, subdivision (a) with the (a)(3) consolidation is usually the faster path to compliance, because one link and one destination page that handles both the sale-and-sharing opt-out and the sensitive-information limit is a contained piece of work.

What is not available is a partial version of either. Both routes are written around the same pair of outcomes, and a build that handles only the first of them satisfies neither subdivision.

Section 1798.135 was last amended by AB 3286, effective 1 January 2025.