Do Not Sell My Personal Information: CCPA Opt-Out Steps and GPC

If you live in California, you can tell a company to stop selling or sharing your personal data by clicking the “Do Not Sell or Share My Personal Information” link that covered businesses are required to display on their websites, or by turning on an automated browser signal that sends the request to every site you visit. The business then has up to 15 business days to comply, and it cannot charge you more or give you worse service for asking.¹

How to Submit the Request

Covered businesses must offer at least two ways to opt out.¹ For companies that collect data online, that means recognizing an opt-out preference signal plus providing at least one of the following: an interactive form behind a “Do Not Sell or Share My Personal Information” link, an alternative opt-out link, or instructions in the privacy policy. The link itself has to sit in the header or footer of the site, not buried three menus deep.

The process must take minimal steps. A business cannot force you to create an account to submit the request. It can ask basic questions to figure out which data is yours, but it cannot require full identity verification the way it might for a deletion request.²

One trap worth knowing: a cookie banner or cookie-management tool by itself does not satisfy the law. Cookies control data collection, not sale or sharing, so the opt-out mechanism has to be specifically about stopping sale and sharing.¹

Use Global Privacy Control to Opt Out Everywhere at Once

Global Privacy Control is an automated signal built into Mozilla Firefox, DuckDuckGo, and Brave, and available as an extension for other browsers. Once you turn it on, GPC tells every participating website that you want to opt out of the sale and sharing of your personal information, and covered California businesses are legally required to honor it.³ It is the closest thing to a universal switch, and it saves you from clicking the opt-out link on every site individually.

Have Someone Else Submit It for You

You can authorize another person to send the request on your behalf. The business can require that agent to produce your signed written permission before processing it.⁴ A GPC signal sent by your browser is treated as coming from you directly, so no separate permission documentation is needed when you use the automated signal.

What Happens After You Opt Out

The business must stop selling and sharing your personal information as soon as feasibly possible, and in no case later than 15 business days after receiving the request.¹ It must also notify any third parties it sold or shared your data with in the period after your request so those downstream recipients stop too.

After you opt out, the business has to wait at least 12 months before asking you to opt back in.² If the company is later acquired by another, the new owner has to honor your original opt-out.⁵

Opting out stops future sales and sharing. It does not delete the data the business already holds, and it does not undo transfers that already happened. If you want the business to erase what it has, that takes a separate deletion request; you can also ask it to correct inaccurate information.⁶ Many people submit opt-out, deletion, and correction requests together.

What You Are Actually Stopping

“Selling” under the CCPA is broader than selling for cash. It covers any transfer of your personal information to a third party for monetary or other valuable consideration.⁷ A company that hands your data to another company in exchange for free analytics or advertising services has sold it, even though no money moved.

“Sharing” is a separate concept added by the California Privacy Rights Act amendments. It means transferring your personal information to a third party for cross-context behavioral advertising, whether or not the business gets anything back.² Cross-context behavioral advertising is the practice behind the running shoes you searched for on one site showing up as ads everywhere else you go. Opting out shuts that pipeline off for your data.

Some transfers do not count as sales or shares and will continue after you opt out. Data sent to a service provider under a written contract that restricts the provider’s use is one. Transfers you specifically direct are another. And if the business is acquired, moving customer data to the new owner is not a sale as long as the new owner stays consistent with the original privacy commitments.⁷

The Separate Link for Sensitive Information

You may also see a “Limit the Use of My Sensitive Personal Information” link on the same sites. This is a related but distinct right. Sensitive personal information is a narrower category that includes your Social Security number, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, genetic and biometric data, health information, and the contents of your private messages.⁸ Businesses that use sensitive data for purposes beyond providing the service you asked for must let you limit that use.

The two rights operate independently. Submitting a “Do Not Sell or Share” request does not automatically limit the use of your sensitive personal information, and vice versa. If both apply to you, click both.

A Business Cannot Punish You for Opting Out

The CCPA prohibits businesses from discriminating against consumers who exercise their privacy rights. That means no denying goods or services, no charging higher prices, no providing lower-quality service, and no suggesting that opting out will cost you anything.⁹ The same protection extends to employees and independent contractors.

There is one carve-out. A business may offer a different price or service level if the difference is reasonably related to the value your data provides.⁹ Loyalty programs and similar financial incentives for sharing data are allowed, but participation has to be voluntary and based on your opt-in consent. In practice, most businesses do not change pricing when you opt out.

If a Business Ignores Your Request

The California Privacy Protection Agency enforces the CCPA and takes complaints through an online portal or by mailed paper form.¹⁰ You can file sworn or unsworn, and you do not need to be in California when you file. Keep a copy of the opt-out request you submitted and anything the business sent back; that record is what gives your complaint teeth.

Penalties run up to $2,663 per violation for unintentional violations and up to $7,988 per violation for intentional ones.¹¹ Those amounts apply through 2026 and are counted per violation, not per company, so ignoring opt-out requests at scale adds up quickly.

Which Businesses Have to Honor Your Request

The CCPA does not reach every company. A for-profit business doing business in California is covered if it meets any one of these thresholds:

Annual gross revenue above $26,625,000. This figure is adjusted for inflation in odd-numbered years; the current amount took effect January 1, 2025, and applies through 2026.¹²
Buying, receiving, selling, or sharing the personal information of 100,000 or more California consumers or households annually.
Deriving 50% or more of annual revenue from selling or sharing personal information. Data brokers and many ad-tech companies fall here.

Subsidiaries and affiliates controlled by or sharing branding with a covered business are also subject to the law, even if the smaller entity would not meet the thresholds on its own.⁷ Nonprofits and government agencies are generally not covered.² Certain data is also exempt: health information handled by HIPAA-covered entities is excluded at the entity level, and specific financial data governed by the Gramm-Leach-Bliley Act is exempt at the data level, though other personal information a financial institution holds remains covered.

Employee and job applicant data had a temporary exemption early on, but that has expired. Covered businesses now owe their workers and applicants the same privacy rights they owe customers.

Minors Do Not Need to Opt Out

The default flips for anyone under 16. Businesses are prohibited from selling or sharing a minor’s personal information unless they first obtain affirmative consent.⁵ Consumers between 13 and 15 can give that consent themselves. For children under 13, a parent or guardian must authorize it. A business that willfully disregards a consumer’s age is treated as knowing it, and penalties for violations involving known minors run up to the higher $7,988 figure.

1
CPPA. CCPA – Effective January 1, 2026 – California Privacy Protection Agency Regulations
2
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
3
State of California Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
4
California Attorney General. CCPA Regulations – Notice of Right to Opt-Out of Sale of Personal Information
5
California Legislative Information. California Code Civ – Section 1798.120
6
California Legislative Information. California Code CIV – Section 1798.105
7
California Legislative Information. California Code Civ – Section 1798.140
8
privacy.ca.gov. What Is Personal Information?
9
California Legislative Information. California Code Civ – Section 1798.125
10
California Privacy Protection Agency. California Privacy Protection Agency Complaint Form
11
California Privacy Protection Agency. Announces 2025 Increases for CCPA Fines and Penalties
12
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA