Do Not Sell My Personal Information link: the CCPA guide

This guide is for the business side: what the link must say, where it goes, what must happen after the click and how to test it. If your site also serves European visitors, keep in mind that the logic is reversed there: the GDPR requires a prior opt-in, as our guide to GDPR consent requirements explains. California works the other way round, and the Do Not Sell link is the centerpiece of that opt-out model.

What "Do Not Sell My Personal Information" means

The original CCPA, in force since January 2020, gave California residents the right to tell a business to stop selling their personal information, and required a homepage link titled "Do Not Sell My Personal Information". The California Privacy Rights Act extended the right to "sharing" from January 2023, and the required title became "Do Not Sell or Share My Personal Information". Many sites still show the old wording; it is worth updating.

Two words carry the whole mechanism:

• Sell means disclosing personal information to a third party for money or "other valuable consideration". A free analytics or advertising tool that gets to reuse your visitors' data in exchange can be a sale.
• Share means disclosing personal information to a third party for cross-context behavioral advertising, paid or not. Retargeting pixels and ad network tags are the typical case.

For a visitor, clicking the link is a way to say "stop". For the business, it is a legal obligation with deadlines, and regulators check that the link actually works. The difference between the two models is detailed in our article on opt-in and opt-out consent, and our guide to explicit, implied and informed consent shows why a silent opt-out would never count as consent in Europe.

Do you need a Do Not Sell link?

You need it if two conditions are met. First, your business falls under the CCPA: a for-profit company doing business in California with annual gross revenue above $26,625,000 (2025 threshold), or that buys, sells or shares the personal information of 100,000 or more California consumers or households, or that earns half or more of its revenue from selling or sharing personal information. The thresholds and the full text are summarized on our CCPA and CPRA law page.

Second, you actually sell or share personal information. Cookie IDs, IP addresses and device identifiers count as personal information in California, so a Meta Pixel, a TikTok Pixel or Google Ads remarketing on your site is usually enough.

If you do not sell or share, section 7013(g) of the regulations says you do not need the notice or the link, provided your privacy policy states that you do not sell or share personal information. That statement has to be true: in its 2022 settlement with Sephora, the California Attorney General found that the retailer let third-party trackers collect data on its site without telling visitors it was selling it.

Where to place the Do Not Sell My Personal Information link

Section 7013(c) requires the link in the header or footer of your internet homepage. Section 7003(c) adds that it must look like the other links next to it: at least the approximate size and color, not a gray footnote in a smaller font. In practice:

• Put it in the global footer, so it appears on every page, not only the homepage.
• Use the exact title: "Do Not Sell or Share My Personal Information".
• If you also use sensitive personal information for purposes beyond what the law allows, add "Limit the Use of My Sensitive Personal Information", or use the combined link described below.
• For a mobile app, section 7003(d) requires the privacy policy to be reachable from the app's platform or download page, and the link may also appear inside the app.

"Do Not Sell or Share" or "Your Privacy Choices"?

Section 7015 offers an alternative: a single link titled "Your Privacy Choices" or "Your California Privacy Choices", with the official opt-out icon (a blue and white toggle) placed right next to the title, at about the same size as the other icons in your header or footer. This one link replaces both "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information".

The trade-off: the page it leads to must explain both rights and offer an interactive way to exercise both. If you only need the sale and sharing opt-out, the classic link is simpler. If you also cover other US state laws, "Your Privacy Choices" is a neutral title that reads naturally outside California.

What must happen after the click

Section 7013(a) gives the link a purpose: to "immediately effectuate" the opt-out. You have two compliant designs.

1. Immediate effect. Clicking opens a toggle or a confirmation that opts the visitor out on the spot. The notice of the right to opt out then lives in your privacy policy.
2. A dedicated page. The link leads to a page that describes the right to opt out of sale and sharing and contains the interactive form required by section 7026(a)(1). The form must be short: no account, no login, no identity documents.

Whatever the design, the opt-out has to reach the tags that actually send data. A form that stores a preference in a database while the Meta Pixel keeps firing is not an opt-out. Before you design anything, list what really runs on your pages. Check in 30 seconds which cookies your site sets with the free cookie scanner, then mark each tracker as necessary, analytics or advertising.

The second half of the job is server-side: data already sent to ad platforms through server events or CRM uploads must stop too. A concrete example of how to wire that: FlowConsent sends a signed consent.withdrawn webhook to your server when a visitor refuses or retracts, which your backend can use to pause server-side sharing for that visitor.

Why a cookie banner is not enough

This is the point most sites get wrong. Section 7026(a)(4) says it plainly: a cookie banner or cookie controls are not, by themselves, an acceptable method for submitting requests to opt out of sale or sharing, because cookies concern the collection of personal information, not its sale or sharing. A "Reject all" button helps, but it does not replace the link.

Section 7026(a) also requires at least two designated methods for opt-out requests, one of which must reflect the way you mainly interact with consumers. For a website, the usual pair is the interactive form behind the link plus the Global Privacy Control signal. Our guide to the CCPA cookie banner explains how the banner, the link and GPC fit together on the same page.

The rules for processing a Do Not Sell request

Section 7026 sets the process, and enforcement actions have targeted each point:

• No account and no verification. You cannot require an account (7026(c)) or a verifiable consumer request (7026(d)). You may ask only for what you need to find the person, such as an email address if they want the opt-out applied to their customer record.
• 15 business days maximum. Stop selling and sharing as soon as feasibly possible, and no later than 15 business days after receiving the request (7026(f)).
• Tell the third parties. Notify the third parties to which you sold or shared the data between the request and the moment you complied, and direct them to honor it (7026(f)).
• One option for everything. You may offer granular choices, but a single "opt out of all sale and sharing" option must also be available (7026(h)).
• Equal effort. The path must be as easy as the path to accept (section 7004). In March 2025 the California Privacy Protection Agency fined Honda $632,500, partly for asymmetrical choices and excessive information requests in its opt-out process.
• No nagging. The statute requires waiting at least 12 months before asking someone who opted out to authorize sale or sharing again.
• Minors. For consumers under 16, the model flips: you may not sell or share their data without opt-in consent (Civil Code 1798.120(c)).

You may show the visitor that the opt-out worked, for example with an "opted out" status or a toggle in the off position (7026(g)).

Global Privacy Control and the frictionless option

Global Privacy Control (GPC) is a browser setting that tells every site "do not sell or share my data". Section 7025 makes it a valid opt-out request, and section 7025(e) is clear that posting the link does not exempt you from honoring the signal: you need both, unless you choose the frictionless route.

Under section 7025(g), you may drop the Do Not Sell and "Your Privacy Choices" links if you process GPC in a frictionless manner (no fee, no change in the experience, no pop-up or interstitial in response to the signal), describe this in your privacy policy, and fully apply the opt-out through the signal. A site that only shares data online for behavioral advertising can qualify. In practice most businesses keep the link, because visitors without GPC still need a way to opt out. The comparison of CCPA and GDPR cookie rules shows how this fits with a European setup.

Checklist: implementing the link step by step

1. Map every tracker and server-side data flow, and decide which ones are sales or shares.
2. Choose the title: "Do Not Sell or Share My Personal Information", or "Your Privacy Choices" with the icon if you also handle sensitive data.
3. Add the link to the global footer, same size and color as its neighbors.
4. Build the destination: an immediate toggle, or a page with the notice and a short form.
5. Connect the opt-out to your tags, so advertising scripts stay blocked for that browser, and to your backend for server-side flows.
6. Honor GPC on every page and record each opt-out with its date.
7. Set up a process to notify third parties and close requests within 15 business days.
8. Test with GPC on and off, in a private window, and check the network panel for advertising requests after opting out.

How FlowConsent handles Do Not Sell requests

FlowConsent applies the opt-in model to every visitor, Californians included: advertising and analytics scripts stay blocked until the visitor accepts, so a visitor who never accepts has nothing sold or shared through your tags. Accept and Reject have equal weight, a floating button lets visitors change their choice at any time, and each decision is kept as exportable proof of consent. For server-side flows, consent webhooks send a signed consent.withdrawn event to your backend when a visitor refuses or retracts. What the documentation does not describe is a ready-made "Do Not Sell or Share" page or automatic GPC detection: the footer link, its destination page and GPC handling remain your responsibility. For a US-first site that needs those built in, our Osano comparison is a fair place to start.