When must a business honor a CCPA opt-out preference signal?

The "Do Not Sell or Share My Personal Information" link is the most visible thing the CCPA asks for, and also the most misunderstood. Businesses assume it only matters if they literally sell data for cash. The law is broader than that, and the word "share" is where most companies discover they are covered after all.

What is the right to opt out of sale or sharing?

Cal. Civ. Code Section 1798.120 gives a California consumer the right, at any time, to tell a business that sells or shares their personal information to stop. The business has to provide notice that the information may be sold or shared and that the consumer can opt out. Once someone opts out, Section 1798.120 prohibits the business from selling or sharing that person's data until they later authorize it again. The right sits with the consumer, so you cannot make it conditional on creating an account or paying a different price.

What counts as "selling" or "sharing"?

This is the trap. Under Cal. Civ. Code Section 1798.140, "selling" is disclosing personal information to a third party for monetary or other valuable consideration. "Sharing" is broader still: it means disclosing personal information for cross-context behavioral advertising, whether or not any money changes hands. So a company that never sells a record but drops a third-party advertising pixel on its site, passing data to an ad network to target people across other sites, is sharing under the CCPA and owes the opt-out. That is why so many sites that swear they do not sell data still need the link.

How do you actually provide the opt-out?

Cal. Civ. Code Section 1798.135 gives two routes. The first is a clear and conspicuous "Do Not Sell or Share My Personal Information" link on your homepage that leads to a page where a consumer can opt out. The second is to honor an opt-out preference signal, such as Global Privacy Control, that a browser or extension sends on the consumer's behalf. If you process that signal for every consumer, you are not required to post the separate link, but most businesses do both because the signal alone is easy to miss. Consumers under 16 flip the default: Section 1798.120 bars selling or sharing their data unless a consumer aged 13 to 16 opts in, or a parent consents for a child under 13.

Browsers will soon have to send the signal

California added Section 1798.136 to the CCPA, and it changes the scale of the preference-signal problem rather than the rule itself.

Section 1798.136(a)(1) provides that a business shall not develop or maintain a browser that does not include functionality, configurable by a consumer, that enables the browser to send an opt-out preference signal to businesses the consumer interacts with through the browser. Section 1798.136(a)(2) requires that functionality to be easy for a reasonable person to locate and configure, and Section 1798.136(b) requires the browser maker to explain publicly how the signal works and what it is intended to do.

Section 1798.136(f) provides that the section becomes operative on 1 January 2027.

Two things follow for an ordinary business. First, this obligation lands on browser developers, not on you: Section 1798.136(d) says a business that develops or maintains a browser with that functionality is not liable for a violation by a business that receives the signal. Second, and more practically, the population of consumers sending an opt-out preference signal is about to grow from the minority who install an extension to anyone who finds a setting. Your own duty under Section 1798.135 does not change, but the number of signals it applies to will.

If your current answer to preference signals is a client-side script that suppresses a banner, that will not hold. The signal has to reach the systems that decide whether data is sold or shared.

Where this fits with your other CCPA duties

The sale-and-sharing opt-out is one of several CCPA rights, and it pairs with the separate control over sensitive data. If you handle categories like precise geolocation or health information, review the right to limit sensitive personal information, which uses its own homepage link. To confirm the CCPA reaches you in the first place, start with does California's CCPA apply to your business.

Whether a transfer is a sale depends on who receives it

Both definitions turn on the same phrase. Section 1798.140(ad)(1) defines a sale as disclosing personal information to a third party for monetary or other valuable consideration, and Section 1798.140(ah)(1) defines sharing as disclosing it to a third party for cross-context behavioral advertising, whether or not money is exchanged. Section 1798.140(ai) then defines a third party as anyone who is not the business, a service provider, or a contractor. That is why the vendor contract, not the data flow, usually decides the answer: see service provider vs third party for the terms that keep a vendor out of the third-party category.

Next step

If you run advertising, analytics, or any third-party tags, the free 2-minute Obligation Scan checks whether your data flows count as selling or sharing and lists the opt-out link, preference-signal, and minors-consent steps the CCPA requires, so an ad pixel does not become a missing-link violation. The US state privacy laws hub shows how California's opt-out compares with other states.