What is Do Not Sell?
Definition
Do Not Sell refers to the CCPA/CPRA requirement for businesses to provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on their website homepage. This mechanism enables California consumers to exercise their right to opt-out of data sales and sharing.
In Depth
The "Do Not Sell or Share My Personal Information" link has become one of the most visible manifestations of CCPA compliance on the internet. Under CPRA, the link text was updated to include "sharing" in addition to "selling" to cover cross-context behavioral advertising. The link must be easily accessible, typically placed in the website footer alongside the privacy policy link. When clicked, it must lead to a simple mechanism for opting out that does not require the consumer to create an account. Businesses must also honor the Global Privacy Control (GPC) signal, a browser-based mechanism that communicates opt-out preferences automatically. The definition of "sale" under CCPA is broad and includes any exchange of personal information for monetary or other valuable consideration. Many businesses were surprised to learn that common practices like sharing data with analytics providers, ad networks, or affiliate partners could constitute a "sale" under this definition. Organizations should conduct a thorough data sharing audit, classify each sharing relationship as a sale or non-sale, and implement technical controls to suppress data flows when consumers opt out.
Related Frameworks
Related Terms
Right to Opt-Out
The right to opt-out under CCPA/CPRA allows California consumers to direct businesses to stop selling or sharing their personal information with third parties. Businesses must honor opt-out requests and provide a clear "Do Not Sell or Share My Personal Information" link on their website.
California Privacy Rights Act
The California Privacy Rights Act (CPRA) is a ballot initiative approved by California voters in November 2020 that significantly amended and expanded the CCPA. It created the California Privacy Protection Agency, introduced new consumer rights, and established requirements for sensitive personal information, effective January 1, 2023.
Sensitive Personal Information
Sensitive personal information under CPRA includes specific categories requiring heightened protections: government IDs, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, mail/email/text content, genetic data, biometrics, health data, and sex life or orientation.
Data Broker
A data broker is a business that knowingly collects and sells to third parties the personal information of consumers with whom it does not have a direct relationship. Under CCPA/CPRA, data brokers must register with the California Attorney General and comply with heightened consumer rights requirements.
Generate compliance docs with PoliWriter
Stop reading about compliance and start achieving it. PoliWriter generates audit-ready policies customized to your organization in hours.
Get Started Free