The Do Not Sell or Share link: what California requires

California does not ask websites for consent before setting cookies. It asks businesses that sell or share Californians' personal information to let them opt out: a clear and conspicuous "Do Not Sell or Share My Personal Information" link on the website, and respect for the Global Privacy Control signal sent by the visitor's browser, treated as a valid opt-out request. Using advertising trackers that send visitor data to ad platforms counts as selling or sharing under the law, which is why a website with Meta Pixel or Google Ads tags and Californian visitors needs the link. Sephora learned this in August 2022, when the Attorney General settled with it for $1.2 million.

The rule

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives consumers the right to opt out of the sale or sharing of their personal information. "Sharing" was added by the CPRA to cover disclosure for cross-context behavioral advertising, with or without money changing hands, which is what closes the argument that sending data to an ad network is not a sale.

The Attorney General's CCPA page states the mechanics. Businesses that sell personal information must "provide a clear and conspicuous 'Do Not Sell or Share My Personal Information' link on their website" and include it in their privacy policy. Consumers can also opt out through a user-enabled global privacy control, which "must be honored by covered businesses as a valid consumer request to stop the sale or sharing" of personal information. A business has up to 15 business days to act on an opt-out request, and once a consumer has opted out it must wait at least 12 months before asking them to opt back in. The Attorney General's page is the plain-language version; the statute is in Civil Code section 1798.135 and the regulations of the California Privacy Protection Agency.

Global Privacy Control is a browser setting (or extension) that sends a Sec-GPC: 1 header with every request and exposes navigator.globalPrivacyControl to scripts. The specification is published at globalprivacycontrol.org. For a website, honoring it means: if the signal is present, treat the visitor as opted out of sale and sharing without waiting for a click.

Three enforcement cases

Sephora, 24 August 2022. The Attorney General announced a $1.2 million settlement. The findings: Sephora did not tell consumers it was selling their personal information, although its arrangement with third-party companies tracking visitors "constituted a sale of consumer information under the CCPA"; it did not honor opt-out requests sent through user-enabled global privacy controls; and it did not cure these problems within the 30-day period the law then allowed. Sephora had to update its disclosures to state that it sells data, offer opt-out mechanisms including the Global Privacy Control, fix its service provider contracts and report to the Attorney General on its data sales and its handling of GPC signals.

American Honda, 12 March 2025. The California Privacy Protection Agency's first enforcement decision ordered Honda to pay $632,500 and change its practices. The agency found that Honda required Californians to verify themselves and provide excessive personal information to exercise the opt-out and limit rights, used a privacy management tool that "failed to offer Californians their privacy choices in a symmetrical or equal way", made it difficult to use authorized agents, and shared personal information with ad tech companies without contracts containing the required terms. Honda was also told to consult a user experience designer about its request methods.

Todd Snyder, 6 May 2025. The agency ordered the clothing retailer to pay $345,178. Its opt-out mechanism had not been properly configured, so opt-out requests went unprocessed for 40 days; it required consumers to submit more information than necessary and to verify their identity before opting out. The head of the enforcement division put the lesson in one sentence: "Using a consent management platform doesn't get you off the hook for compliance."

Together, the three cases say what the link must do: exist, be visible, work without an account or identity check, treat the GPC signal as an opt-out, and be symmetrical with the option to accept.

Who is covered

The CCPA applies to for-profit businesses that do business in California and meet one of its thresholds on revenue, on the volume of consumers' personal information handled, or on the share of revenue from selling or sharing personal information. A business below the thresholds is outside the law; most companies with a meaningful Californian customer base are inside it. Other US states have adopted opt-out rights of their own, several of which also require honoring universal opt-out signals; the US state privacy laws overview lists them, and the CCPA and CPRA law page covers California in more depth.

How to implement it on a website

1. Decide whether you sell or share. If the site runs Meta Pixel, Google Ads remarketing, TikTok, LinkedIn or any ad network tag that receives visitor data, the answer is almost certainly yes. Analytics used only for your own measurement is a closer question; the ad tags are not.
2. Add the link. "Do Not Sell or Share My Personal Information" in the footer of every page and in the privacy policy, leading to a page or a panel where the visitor can opt out in one step, with no account and no identity verification.
3. Honor GPC. Read the signal in the browser and treat it as an opt-out: stop the advertising tags for that visitor and record the opt-out.
4. Make the opt-out real. Opting out must stop the sharing: the ad tags must not fire for that visitor afterwards, on every page, for the duration of the opt-out. Record the choice so it persists.
5. Keep it symmetrical. The path to opt out may not be longer than the path to stay opted in. One click to allow, one click to refuse.
6. Act within 15 business days on requests made through forms or e-mail, and do not ask the visitor to opt back in for 12 months.
7. Fix the contracts. Ad tech recipients need the contractual terms the law requires; Honda's decision made this a finding.

Where a cookie banner fits

A European-style consent banner is not what California requires, and showing one to Californians is not what the law asks either. The right pattern is a notice for visitors in states with an opt-out law: a short message with the "Do Not Sell or Share" link, trackers running by default, and immediate opt-out when the visitor clicks or when their browser sends GPC. Cookiequiet does this with geo-targeting: visitors in the EEA, the UK and other consent countries see the consent banner, visitors in California and other US states with a privacy law see an opt-out notice with the Do Not Sell or Share link, and the Global Privacy Control signal is honored as an opt-out, with the choice logged like any other. The categories, the blocking and the record keeping are the same machinery as the consent banner, which is what makes the two models fit on one site.