The CCPA “Do Not Sell My Personal Information” Guide
The California Consumer Privacy Act (CCPA) has significantly influenced privacy rights in the US, giving Californians greater control over their personal data and providing other states with an example of comprehensive privacy legislation.
One of the most visible provisions of CCPA is the “do not sell my personal information” link that many businesses must display on their websites, forms, checkout pages, etc., before collecting a customer’s personal data. This link makes companies honor users’ requests not to sell their personal data, which is both a compliance obligation and a critical part of building consumer confidence and brand loyalty.
As Jeannine Crooks, an ex-Partner Acquisition & Development Manager of Awin and a founder of Sled Dog Consulting, stated in Phonexa’s Amplify webinar series:
“Put your audience first. Seriously. There are always those high-ticket items that can bring you a lot of money if you sell them, but is that really putting your audience first? If it’s not, don’t do it. You may have just spent years building the trust of that audience, and you could lose it all because it seems like you’re chasing their money rather than trying to help their audience”.
Sign up with ValidRecord to protect your business from fraud & screen leads in real-time.
What Does “Do Not Sell My Personal Information” Mean?
Under the CCPA, the right to opt out of the sale of personal information applies broadly because “selling” includes: “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.”
The problem is that companies sometimes believe they do not sell information when they actually do. For example, if your website uses third-party cookies for behavioral advertising or cross-site tracking, you are likely engaging in the sale of personal information. In this case, you must provide a clear “do not sell my personal information” link to give users a choice regarding their data.
“Personal information” under the CCPA is information that identifies, relates to, characterizes, or is reasonably capable of being associated with you, including your real name, postal address, email address, IP address, purchase history, and browsing history (every page you visit, every ad you click, your geolocation data, too).
Another personal information category includes inferred data profiles – inferences – which are conclusions about who you are that companies make based on the collected data. Then they use those conclusions to make data-driven marketing decisions, such as engaging you in a way that is likely to resonate with your needs and wants.
CCPA vs. CPRA: What’s the Difference?
The original California Consumer Privacy Act (CCPA) gave consumers the basic right to opt out of the selling of their personal data, while the California Privacy Rights Act (CPRA), which took effect on January 1, 2023, expanded the framework to cover specifically the “sharing” of personal information for cross-context behavioral advertising, with or without compensation.
Businesses now have to include a “do not sell or share my personal information” link to cover both selling and sharing. When a customer clicks this type of link, they exercise their CPRA opt-out rights, and the company is prohibited from sharing their data for targeted advertising purposes. In practice, this new rule stops businesses from claiming they merely “share” data, rather than “sell” it.
Who Needs to Comply with CCPA and CPRA?
Not every business is required to feature a “we will not sell your information” disclaimer, or a “do not sell” link. The CCPA and CPRA apply specifically to for-profit companies that do business in California and meet certain financial or data volume thresholds.
A business must comply if it meets any of the following criteria:
- Annual gross revenue of over $25 million
- Buys, receives, sells, or shares the personal information of 100,000 or more California residents, households, or devices annually
- Derives 50% or more of its annual revenue from selling or sharing personal information
If your business is located in another state or overseas, but you provide services to people in California and meet these requirements, the law still applies.
How to Handle the Do Not Sell My Personal Information Requests
You must have efficient systems in place when a user exercises their privacy rights and requests to opt out of sharing personal information. You must respond to these requests as soon as reasonably practicable, and in any event within 15 business days. If a consumer has opted out, you cannot ask them for reauthorization of the sale or sharing of their data for at least 12 months.
The CCPA has different rules for children. Users under 16 must affirmatively consent to the selling of their personal information, and users under 13 must have parental authority. Providing the link is only part of it – you need to make sure your internal data system complies with every valid request.
Implementing the Link & Notice on Your Website
Companies are required to publish the “do not sell my personal information” link on their homepage and on every online page where they collect personal information, leading consumers to a page dedicated to personal information or to a list of “do not sell my personal information” choices, making it easy to submit their request.
Important: You cannot require a user to create an account in order to exercise the right to opt out.
CCPA Compliance and Consent Management Platforms (CMPs)
The good news is that there are consent management platforms (CMPs) to help you manage CCPA compliance. If a user clicks “do not disclose my personal information,” the platform will automatically update their preferences and prevent non-essential cookies from following them.
It’s legally required to have a clear privacy policy that describes customers’ rights and the exact categories of data collected. Also, companies have to automatically honor a legitimate “do not sell my data” request when a user has enabled a Global Privacy Control (GPC) signal in their browser.
How Consumers Can Protect Their Data
From the consumer’s perspective, discovering that companies commercialize their personal information can be frustrating.
To better protect your personal information, proactively send opt-out requests, use privacy-focused browsers with Global Privacy Control enabled, and be mindful of the details you provide online. Likewise, check website footers for “do not sell my personal information” links and disable third-party tracking.
ValidRecord: Elevating Your Data Compliance & Quality
As data privacy rules get more complicated, ValidRecord can help you remain compliant and prevent marketing fraud:
- iClaim captures, stores, and transfers customer consent to buyers when the lead is sold, providing verifiable digital evidence that the lead is genuine and has given their consent for marketing communications.
- iClear screens leads in real time, allowing you to automatically accept, reject, or flag consumers based on predefined criteria.
Together, iClaim and iClear help create a risk-free environment for lead generation and distribution, so you can buy or sell leads while being confident you comply with CCPA and other pertinent regulations.
Sign up with ValidRecord to screen leads in real-time and prevent fraud.
Frequently Asked Questions
How do laws like CCPA protect my personal data from being sold?
The CCPA protects consumers by requiring companies to properly disclose to customers the fact of personal data collection and intended use. As a result, consumers can opt out of having their data sold or shared with third parties, and businesses must honor those privacy decisions.
Are there any legal regulations governing the sale of personal data?
Yes. A few jurisdictions have actually stepped up with extensive privacy laws. California has some of the most thorough privacy laws, the CCPA and CPRA. Within these laws, violations can trigger significant regulatory fines.
Is it legal to sell consumer data?
The short answer is yes, provided you comply with the privacy rules and offer an easy way to opt out. That said, there are still limits on the sale of personal data established by the CCPA, CPRA, VCDPA (Virginia), and CPA (Colorado).
Can I sue a company for selling my information?
The CCPA does not allow consumers to sue a company simply for selling the consumer’s information or for refusing an opt-out request. In general, private claims are limited to particular data breaches, including unencrypted personal information and a failure to use reasonable security measures.
