The “Do Not Sell or Share” link: titles, placement and the page behind it
If your business sells or shares personal information, California expects a specific link on your home page — with a specific title, in a specific place, leading to a page where the visitor can actually opt out. Small deviations are common: a creative title, a link tucked into a menu, a page that explains the right but offers no way to use it.
Last reviewed
When the link is required
The CCPA requires a business that sells or shares consumers’ personal information to “provide a clear and conspicuous link on the business’ internet homepages, titled ‘Do Not Sell or Share My Personal Information,’ to an internet web page that enables a consumer … to opt out of the sale or sharing” (Cal. Civ. Code § 1798.135(a)(1)). “Sharing” covers disclosure for cross-context behavioral advertising even without payment (§ 1798.140(ah)), which is why the question comes up for many sites that run advertising pixels.
A business that does not sell or share personal information does not need the link, provided its privacy policy says that it does not sell or share (11 CCR § 7013(g)). A business may also skip the link if it processes opt-out preference signals such as Global Privacy Control in a “frictionless manner” and meets further conditions, among them statements in its privacy policy and a signal that fully carries out the opt-out, including any offline sale (§ 7025(g)). A business that also sells data offline generally cannot rely on that route, as the regulation’s own example shows (§ 7025(g)(3)(A)).
Sources: CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA)CCPA regulations, 11 CCR § 7000 ff. (CPPA)
Permitted titles
The statute and regulations name the titles. A link titled differently does not match them.
- “Do Not Sell or Share My Personal Information” — the title the statute prescribes (§ 1798.135(a)(1); 11 CCR § 7013).
- “Limit the Use of My Sensitive Personal Information” — a second, separate link, required only if the business uses or discloses sensitive personal information beyond the purposes the regulations allow (§ 1798.135(a)(2); 11 CCR § 7014).
- “Your Privacy Choices” or “Your California Privacy Choices” — the Alternative Opt-out Link, which may replace both links above. It must show the opt-out icon next to the title, about the same size as other icons in the header or footer; the colors may be adjusted so the icon stays visible (11 CCR § 7015(b)).
Sources: CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA)CCPA regulations, 11 CCR § 7000 ff. (CPPA)
Where the link goes
The link must sit in the header or the footer of the business’s home page (11 CCR § 7013(c); § 7015(b)(1)). It must also be conspicuous: it “shall appear in a similar manner as other similarly-posted links”, using “a font size and color that is at least the approximate size or color as other links next to it” (§ 7003(c)). In a mobile app, the link belongs in the privacy policy, reachable from the app’s store or download page and from within the app, for example its settings menu (§ 7003(d)).
What the link must lead to
Clicking the link must either opt the visitor out immediately or lead to a page “where the consumer can learn about and make that choice” (11 CCR § 7013(a)). That page carries the Notice of Right to Opt-out: a description of the right and, online, “the interactive form by which the consumer can submit their request” (§ 7013(e)(1), (f)). The Alternative Opt-out Link leads to one page that covers both opting out and limiting the use of sensitive information, with a form or mechanism that is easy to use and requires minimal steps (§ 7015(c)).
The request itself has rules too:
- No account and no information beyond what is needed to carry out the opt-out (§ 7026(c)).
- No identity verification: a business “shall not require a verifiable consumer request” for an opt-out (§ 7026(d)).
- Selling and sharing stop as soon as feasibly possible, no later than 15 business days after the request (§ 7026(f)(1)).
- The consumer must be able to confirm that the request was processed (§ 7026(g)).
- The link does not replace Global Privacy Control; the business must still process the signal (§ 7025(e)).
Common mistakes
- A title the rules do not name: “Do Not Sell My Data”, “Privacy Settings” or “Cookie Preferences”.
- “Your Privacy Choices” without the opt-out icon next to it.
- The link only inside a collapsed menu, on the privacy policy page or on an inner page — not in the home page’s header or footer.
- A link that is smaller or fainter than the links next to it.
- A link that only reopens the cookie banner. A cookie tool is “not by itself an acceptable method” for opting out of sale or sharing (§ 7026(a)(4)).
- A page that explains the right but offers only an e-mail address or a phone number, with no interactive form.
- A form that asks the visitor to log in or prove their identity before opting out.
- A form that accepts the request but changes nothing: the same advertising services keep loading afterwards.
Two published cases show the last two patterns. The California Privacy Protection Agency’s action against Todd Snyder, announced on May 6, 2025 ($345,178), found that its privacy portal could not process opt-out requests for 40 days and that consumers had to verify their identity before they could opt out. In the Attorney General’s Healthline settlement of July 1, 2025 ($1.55 million), the consent banner did not disable tracking cookies as it said it would, and data still went to some advertising third parties after consumers opted out.
Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)CPPA, Todd SnyderCalifornia Attorney General, Healthline
This guide summarizes the official texts for orientation. It is not legal advice and does not tell you whether a law applies to your business. Ask an attorney licensed in California how the rules apply to you.