What does the CCPA 'Do Not Sell or Share My Personal Information' right require?

The "Do Not Sell or Share My Personal Information" link is the most visible thing the CCPA asks for, and also the most misunderstood. Businesses assume it only matters if they literally sell data for cash. The law is broader than that, and the word "share" is where most companies discover they are covered after all.

What is the right to opt out of sale or sharing?

Cal. Civ. Code Section 1798.120 gives a California consumer the right, at any time, to tell a business that sells or shares their personal information to stop. The business has to provide notice that the information may be sold or shared and that the consumer can opt out. Once someone opts out, Section 1798.120 prohibits the business from selling or sharing that person's data until they later authorize it again. The right sits with the consumer, so you cannot make it conditional on creating an account or paying a different price.

What counts as "selling" or "sharing"?

This is the trap. Under Cal. Civ. Code Section 1798.140, "selling" is disclosing personal information to a third party for monetary or other valuable consideration. "Sharing" is broader still: it means disclosing personal information for cross-context behavioral advertising, whether or not any money changes hands. So a company that never sells a record but drops a third-party advertising pixel on its site, passing data to an ad network to target people across other sites, is sharing under the CCPA and owes the opt-out. That is why so many sites that swear they do not sell data still need the link.

How do you actually provide the opt-out?

Cal. Civ. Code Section 1798.135 gives two routes. The first is a clear and conspicuous "Do Not Sell or Share My Personal Information" link on your homepage that leads to a page where a consumer can opt out. The second is to honor an opt-out preference signal, such as Global Privacy Control, that a browser or extension sends on the consumer's behalf. If you process that signal for every consumer, you are not required to post the separate link, but most businesses do both because the signal alone is easy to miss. Consumers under 16 flip the default: Section 1798.120 bars selling or sharing their data unless a consumer aged 13 to 16 opts in, or a parent consents for a child under 13.

Where this fits with your other CCPA duties

The sale-and-sharing opt-out is one of several CCPA rights, and it pairs with the separate control over sensitive data. If you handle categories like precise geolocation or health information, review the right to limit sensitive personal information, which uses its own homepage link. To confirm the CCPA reaches you in the first place, start with does California's CCPA apply to your business.

Whether a transfer is a sale depends on who receives it

Both definitions turn on the same phrase. Section 1798.140(ad)(1) defines a sale as disclosing personal information to a third party for monetary or other valuable consideration, and Section 1798.140(ah)(1) defines sharing as disclosing it to a third party for cross-context behavioral advertising, whether or not money is exchanged. Section 1798.140(ai) then defines a third party as anyone who is not the business, a service provider, or a contractor. That is why the vendor contract, not the data flow, usually decides the answer: see service provider vs third party for the terms that keep a vendor out of the third-party category.

Next step

If you run advertising, analytics, or any third-party tags, the free 2-minute Obligation Scan checks whether your data flows count as selling or sharing and lists the opt-out link, preference-signal, and minors-consent steps the CCPA requires, so an ad pixel does not become a missing-link violation. The US state privacy laws hub shows how California's opt-out compares with other states.