Set up the Do Not Sell or Share link

Last updated 2 November 2026

US state privacy laws, led by California's CCPA and its amendment, the CPRA, give people the right to opt out of the sale or sharing of their personal information. A business that sells or shares it is expected to offer a clear link, usually in the site footer. Kukie.io provides the opt-out dialog behind that link and records each opt-out.

What the link is for

A clear and conspicuous link, usually titled "Do Not Sell or Share My Personal Information", where the visitor can opt out.
The opt-out takes effect without the visitor creating an account.
Many US states also expect you to honour a Global Privacy Control signal as an opt-out. Turn on Respect Global Privacy Control on the Banner Editor's Behaviour tab.

Whether your site needs the link depends on what you do with personal information. This guide explains how Kukie.io works, not what the law requires of you.

Turn on the dialog

In the Banner Editor, open the Regions tab and open the rule for the visitors who should get the dialog, for example California or United States. A new Opt-out rule starts with the dialog on.
Under Advanced, turn on Do Not Sell or Share dialog.
Select Save rule.

Add the link to your site

Kukie.io does not add the link to your pages or to the banner. Add it to your footer yourself. The rule shows this code with a Copy link code button:

<a href="#" data-cc-dnsmpi>Do Not Sell or Share My Personal Information</a>

Any element with the data-cc-dnsmpi attribute opens the dialog, including one your page adds later. The link works for visitors whose rule has the dialog on. For visitors whose rule has it off, it does nothing.

The dialog, titled "Your Privacy Choices", shows the visitor's current state and a checkbox to opt out. When the visitor ticks it and saves:

Every optional cookie category is refused, the same as Reject all: analytics, marketing and functional scripts stop, and only necessary cookies stay.
With Google Consent Mode on, Google is sent a denied update.
The choice is kept for the rule's consent duration.
With consent logging on, the opt-out is recorded in the Consent Log with the action opt_out.

Saving without changing the checkbox changes nothing that is already recorded. On an Opt-in rule, an unticked save never grants consent: visitors there accept through the banner.

Visitors who send Global Privacy Control

When Respect Global Privacy Control is on and the visitor's browser sends the signal, the dialog shows the checkbox ticked, the heading "Opt-Out Request Honored" and the sentence "Your browser sent a Global Privacy Control signal, so we have opted you out of the sale and sharing of your personal information." If the visitor's saved choice allows one of your optional cookie categories (for example Accept All in an Opt-in banner), the dialog instead shows the box unticked and the sentence below.

On an Opt-out, Notice only or Hidden rule the visitor can still untick the box and save. That choice is kept on later visits, and the dialog then shows the box unticked with "You have allowed the sale and sharing of your personal information on this website, although your browser sends a Global Privacy Control signal." On those rules the banner's preferences show the same status.

On those rules the banner also records the signal as the visitor's opt-out the first time it sees it, without showing the banner. These sentences are built into the banner in every language, and the Banner Editor has no field for them.

Each opt-out is a Consent Log entry with the action opt_out, so you can filter the log by action to list them and export them as a CSV file. Opt-outs the banner records from a Global Privacy Control signal have the same action, and the log does not show which of the two an entry was.

A common setup

California: Opt-out, with the Do Not Sell or Share dialog on.
Other US states with a privacy law: a rule of their own, or a United States rule, set to Opt-out with the dialog on.
European Union, United Kingdom and Switzerland: Opt-in, which already blocks optional scripts until the visitor accepts.
Rest of World: the model you choose for everyone else.

California asks businesses to wait at least 12 months before asking someone who opted out to opt back in, so keep the consent duration at 365 days or more on those rules.