The California Consumer Privacy Act (CCPA) grants residents the explicit right to stop businesses from selling or sharing their personal information. In practice that means three things on a website: a "Do Not Sell or Share My Personal Information" link (or the alternative "Your Privacy Choices" link), honouring Global Privacy Control signals as opt-outs, and, since 1 January 2026, showing visitors whether their opt-out was processed.
This opt-out mechanism is the backbone of US privacy law for websites, and it differs from the European GDPR model. Website owners serving Californian visitors must give them a clear path to exercise this right.
You cannot hide this option deep within a privacy policy or make users jump through complex hoops. The law asks for visibility, simplicity and the technical readiness to process automated signals. If your website keeps loading advertising tags after a visitor opts out, or ignores a GPC signal, you are breaking these rules.
What qualifies as selling or sharing
The CCPA definition of "selling" goes far beyond exchanging data for money. It covers any disclosure of personal information to a third party for monetary or other valuable consideration. If you use third-party advertising trackers on your website, you are likely engaging in a "sale" under California law.
"Sharing" specifically targets cross-context behavioural advertising. This means making a consumer's personal information available to a third party to target advertising based on their activity across different websites.
A typical e-commerce site using the Meta Pixel falls directly into this category.
Data transfers to formally designated service providers do not count as a sale or share, provided a contract with the required terms is in place. The vendor must be contractually restricted from using the data for any purpose other than providing the specified service to your business. If a vendor uses your data to improve its own products or build profiles for others, it acts as a third party, and the transfer can be a sale or share.
Visitors have the right to stop these data transfers. You must honour the request without requiring the visitor to create an account or verify their identity. The process must take minimal steps, and the opt-out path cannot be harder than the path to opt back in. Dark patterns, such as confusing toggles or a hidden decline option, mean the choice does not count.
While functional cookies often fall outside these rules if they do not share data across contexts, marketing trackers need strict control. A consent management platform helps automate this separation by blocking tags until the right conditions are met.
The "Do Not Sell or Share" link
The most visible requirement of the law is the footer link. You must place a clear, conspicuous link titled "Do Not Sell or Share My Personal Information" on your homepage and any page that collects personal data.
This link must open a dialog or webpage that lets the visitor opt out of selling and sharing straight away. When a visitor confirms their choice, your website should stop firing the relevant marketing and analytics cookies that share data. Waiting for the next page load leaves the data transfer running.
The CCPA regulations offer an alternative to the long text link. Section 7015 lets a business use an Alternative Opt-out Link titled "Your Privacy Choices" or "Your California Privacy Choices", with the state's opt-out icon next to it, a blue toggle-style mark. This consolidated link must take the visitor to a page where they can exercise both their opt-out right and their right to limit the use of sensitive personal information. Whichever wording you choose, the link must be prominent and must work.
Global Privacy Control and automated signals
California law recognises that clicking a footer link on every website creates friction. To solve this, the CCPA requires businesses to respect opt-out preference signals. The most widely used is Global Privacy Control (GPC), a browser-level signal that broadcasts the visitor's choice to opt out of sale and sharing. When a visitor arrives with GPC turned on, your website must read that signal and apply the opt-out automatically.
You cannot ask the visitor to confirm their GPC choice before you honour it. The regulations do let you tell a signed-in visitor that the signal conflicts with their saved settings and offer them a chance to consent, but you must process the opt-out unless they say otherwise.
The signal arrives as an HTTP header (Sec-GPC: 1) and as a JavaScript property (navigator.globalPrivacyControl), as the Global Privacy Control specification describes. Because the header comes with the browser's first request, a server can leave advertising scripts out of the page entirely. On the client side, your consent manager must read the property and keep tags from firing. Loading a tracker first and removing it after the signal is detected is risky, because by then the tracker may already have sent data.
The 2026 rule: show that the opt-out was processed
Revised CCPA regulations that took effect on 1 January 2026 changed how businesses must handle opt-out preference signals.
Previously, section 7025 said a business "may" display whether it had processed a consumer's opt-out preference signal. The revised text says it "must". The regulations give an example: displaying "Opt-Out Request Honored" on the website when a browser or device sending the signal visits, and showing through a toggle or radio button that the consumer has opted out of sale and sharing. That wording is an example, not a required phrase, but silently honouring the signal no longer meets the rule.
Section 7026 adds a matching duty for opt-outs made through your link or form: a business must give consumers a way to confirm that their request has been processed, for example the same message or the state of a toggle in their privacy settings.
Most implementations show a short notice or update the status in the privacy settings as soon as the signal is detected. If a visitor returns, their settings should still show that the opt-out is active.
Enforcement actions and fines
The California Attorney General and the California Privacy Protection Agency (CPPA) both police these technical requirements, and the published cases read like a checklist of what goes wrong:
- Sephora (August 2022): settled with the Attorney General for $1.2 million for failing to process GPC signals and lacking a working opt-out.
- DoorDash (February 2024): paid $375,000 to the Attorney General for selling customer data through a marketing co-operative without notice or an opt-out.
- American Honda (March 2025): fined $632,500 by the CPPA, partly for asking for too much information before processing opt-outs and for a privacy tool that did not offer choices symmetrically.
- Todd Snyder (May 2025): fined $345,178 after a misconfigured privacy portal left opt-out requests unprocessed for 40 days.
- Tractor Supply (September 2025): fined $1.35 million, the CPPA's largest fine, for an opt-out that did not work for GPC signals among other failures.
- Disney (February 2026): paid $2.75 million because its opt-outs covered one streaming service or one device instead of the whole account. The Attorney General's Disney announcement says a GPC opt-out applied only to the device in use, even for a signed-in consumer.
- PlayOn Sports (March 2026): fined $1.1 million for making visitors click "agree" to tracking and for ignoring opt-out preference signals.
- Ford (March 2026): fined $375,703 for requiring an email confirmation before acting on opt-outs, and ordered to honour GPC, according to the CPPA's Ford announcement.
Regulators also coordinate: on 9 September 2025, the CPPA and the Attorneys General of California, Colorado and Connecticut announced a joint sweep of businesses that may not be honouring GPC. The CPRA removed the mandatory 30-day cure period, so a business cannot count on a chance to fix a violation before a penalty.
How to test your website's opt-out handling
Testing your implementation requires a few tools to simulate California traffic and GPC signals. First, you may need a VPN to route your connection through California, because many consent platforms use geolocation to show the opt-out link only to relevant visitors.
Next, turn on GPC in a browser that offers it, such as Firefox's settings or the Brave and DuckDuckGo browsers, which turn it on by default, or install an extension such as the EFF's Privacy Badger. Open your browser's developer tools and go to the Network tab.
Load your website and watch the network requests. If you see calls to Meta, Google Ads or TikTok while GPC is on, your site is not honouring the signal. Then look for the status your site shows. If nothing tells the visitor that the signal was processed, or if the trackers keep firing, your setup does not meet the 2026 rules.
Run a full scan to catch hidden pixels that fire outside your tag manager. A single forgotten script is enough to share data after an opt-out.
Questions about Do Not Sell or Share
Do I need a Do Not Sell link if I only use Google Analytics?
It depends on the configuration. Google Analytics used only under service-provider terms, without Google signals or links to Google Ads, is usually not a sale or share. With advertising features or Ads linking turned on, it is likely sharing, and you need an opt-out.
What is an opt-out preference signal?
It is a technical signal sent by a browser or extension, such as Global Privacy Control, that automatically communicates a visitor's choice to opt out of the sale and sharing of their personal information.
When did the rule to show that an opt-out was processed take effect?
On 1 January 2026, when the revised regulations changed "may" to "must". Businesses must show whether they processed an opt-out preference signal, for example with a message such as "Opt-Out Request Honored" and a toggle in the privacy settings.
Can I ask users to verify their identity before opting out?
No. The CCPA regulations do not let businesses require a verifiable consumer request to opt out of selling or sharing. Ford was fined $375,703 in March 2026 for requiring an email confirmation first.
Does the CCPA require a cookie banner like the GDPR?
No. Unlike the GDPR's opt-in model, the CCPA operates on an opt-out basis. You do not need prior consent to set cookies, but you must provide a clear way for visitors to opt out of sale and sharing at any time.
See what your site shares before a visitor opts out
If your website receives traffic from California, you need a working opt-out and correct GPC handling. Kukie.io scans your site for first-party and third-party cookies and categorises them, can treat a GPC signal as an automatic opt-out in the regions where you use an opt-out model, and opens its "Your Privacy Choices" opt-out dialog, which states whether the visitor has opted out, from any link you mark with the data-cc-dnsmpi attribute once the Do Not Sell link is turned on for a region.
You can try it on the free plan.
