Under the California Consumer Privacy Act, the “Do Not Sell or Share My Personal Information” right lets you tell a covered business to stop transferring your personal data to third parties for money, other valuable consideration, or cross-context behavioral advertising. You can exercise it through a link on the company’s homepage, by turning on a Global Privacy Control signal in your browser, or by using an authorized agent, and the business cannot make you verify your identity first.
What “Sell” and “Share” Actually Cover
The breadth of these two words is the part most people get wrong. A “sale” under the CCPA happens whenever a business discloses, makes available, or transfers your personal information to a third party for monetary or other valuable consideration.1California Legislative Information. California Civil Code CIV 1798.140 No cash needs to change hands. A company that trades your data for free analytics tools or advertising credits is still selling it.
“Sharing” was added by the California Privacy Rights Act and covers a narrower but very common practice: handing your personal information to a third party for cross-context behavioral advertising, even when nothing of value flows back to the business. Cross-context behavioral advertising is targeting ads to you based on your activity across sites, apps, or services other than the one you are using at the moment.1California Legislative Information. California Civil Code CIV 1798.140 When a website lets an ad network drop tracking cookies that follow you around the internet, that is sharing, and you can stop it.
Personal information itself is defined broadly. It includes anything that identifies, relates to, or could reasonably be linked to you or your household: name, email, IP address, browsing and search history, geolocation, purchase records, biometric data, and profiles inferred from any of these.1California Legislative Information. California Civil Code CIV 1798.140
How to Opt Out
You can exercise this right at any time, and the law gives you more than one route.2California Legislative Information. California Civil Code CIV 1798.120
The Homepage Link
A business that sells or shares personal information has to post a clear, conspicuous link on its homepage titled “Do Not Sell or Share My Personal Information.” Clicking it takes you to a page where you submit the request. The business is allowed to combine this with the separate link for limiting sensitive personal information, as long as the combined link is clearly labeled and easy to find.3California Legislative Information. California Civil Code CIV 1798.135
Global Privacy Control
Rather than clicking through on every site, you can enable a Global Privacy Control (GPC) signal in your browser or through an extension. Covered businesses must honor it as a valid opt-out. The regulations treat a GPC signal as coming directly from you, not from a third-party agent, so a business cannot reject it for lack of identity verification.4State of California – Department of Justice – Office of the Attorney General. Notice of Right to Opt-Out of Sale of Personal Information
Authorized Agents
You can designate someone else to submit the request for you. The agent needs your signed written permission, and the business can deny the request if the agent cannot produce it.4State of California – Department of Justice – Office of the Attorney General. Notice of Right to Opt-Out of Sale of Personal Information
No Identity Verification
Opt-out requests work differently from deletion or access requests. A business cannot require you to verify your identity, create an account, or hand over more information than is needed to process the request. The only out is a documented, good-faith belief that the request is fraudulent, and even then the business has to explain its reasoning to you.
What the Business Has to Do After You Ask
Once a business receives your request, it must stop selling and sharing your personal information as soon as feasible, and no later than 15 business days after it comes in.5California Privacy Protection Agency. CCPA Regulations If it sold your data to any third parties between the time you submitted the request and the time it finished processing, it has to notify those third parties and direct them to stop as well.
Your opt-out stays in place indefinitely. The business cannot resume selling or sharing unless you later give fresh consent,2California Legislative Information. California Civil Code CIV 1798.120 and it must wait at least 12 months before it can even ask you to reconsider.5California Privacy Protection Agency. CCPA Regulations Any information collected from you in connection with the opt-out request can only be used for processing that request.
Which Businesses Have to Honor Your Request
The CCPA does not cover every company. It applies to for-profit businesses that do business in California and meet at least one of three thresholds:
- Gross annual revenue above $25 million.
- Buying, selling, or sharing personal information of 100,000 or more California residents or households.
- Deriving 50 percent or more of annual revenue from selling California residents’ personal information.
Headquarters location does not matter. A company based anywhere in the country falls under the law if it meets a threshold and collects data from California residents.6State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
When the Opt-Out Doesn’t Apply
Several categories of data transfer are carved out of the definition of sale and share. Your opt-out does not reach them.
Service Providers and Contractors
When a business sends your data to a service provider or contractor working under a written contract that bars the provider from selling, sharing, or using the data for anything outside the contract, that transfer is not a sale.7Legal Information Institute. California Code of Regulations Title 11 7051 – Contract Requirements for Service Providers and Contractors A payment processor running your credit card or a cloud host storing a company’s database falls in this bucket.
Transfers You Direct
If you intentionally tell a business to send your information to a third party, that is not a sale. Your action has to clearly show you meant to interact with that third party. Asking a comparison site to send your details to several insurers for quotes is the kind of transfer this covers.1California Legislative Information. California Civil Code CIV 1798.140
Mergers, Acquisitions, and Bankruptcy
Transferring personal information as part of a merger, acquisition, or bankruptcy is also exempt when the receiving company takes over all or part of the business. If the acquirer later wants to use your data in a way materially inconsistent with the privacy promises made when it was collected, it has to give you advance notice and an easy way to exercise your CCPA rights at that point.1California Legislative Information. California Civil Code CIV 1798.140
Stronger Rules for Minors
For consumers under 16, the default flips. If a business has actual knowledge that a consumer is under 16, it cannot sell or share that person’s data at all without affirmative opt-in consent. Teens between 13 and 15 can give that consent themselves; for children under 13, a parent or legal guardian has to authorize it. A business that willfully disregards a consumer’s age is treated as having actual knowledge of it, so pleading ignorance is not a defense.2California Legislative Information. California Civil Code CIV 1798.120
No Retaliation for Opting Out
A business cannot punish you for exercising this right. The CCPA prohibits it from denying you goods or services, charging you a higher price, imposing penalties, providing a lower quality of service, or suggesting that any of those will happen because you opted out. Employees, job applicants, and independent contractors are also protected: if your employer is a covered business and you opt out, the company cannot hold that against you in any employment decision.8California Legislative Information. California Civil Code CIV 1798.125
What Happens if a Business Ignores You
The California Privacy Protection Agency enforces the CCPA through administrative actions. The statutory penalty is up to $2,500 per violation, rising to $7,500 for intentional violations or any violation involving personal information of a consumer the business knows is under 16.9California Legislative Information. California Civil Code CIV 1798.155 Those figures are adjusted for inflation, and through 2025 the adjusted amounts are $2,663 and $7,988.10California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases
The per-violation structure is what makes the exposure serious. A company that ignores opt-out requests from thousands of people can see each affected consumer counted as a separate violation, and a single enforcement action can produce penalties in the millions.