Published August 20, 2026 · 9 min read · RegSentry blog
Adding the link was the easy part. The question almost nobody checks is whether clicking it actually stops anything, and that is the part that creates exposure.
Almost every guide about the "Do Not Sell or Share My Personal Information" link answers the same two questions: do I need one, and what should it say. Both are worth answering, and both are the easy part. The harder question — the one that creates actual exposure — is what happens after a visitor clicks it. On a large number of sites, the honest answer is: a form gets submitted, someone gets an email, and the next page load fires exactly the same set of third-party requests it fired before. The link is present. The opt-out is not.
This guide is about closing that gap: what the link is supposed to accomplish under California's framework, why "sharing" catches people off guard, what a wired opt-out has to actually do, how the Global Privacy Control signal breaks form-only setups, and how to test your own site in an afternoon. It is general information, not legal advice — confirm specifics with counsel who knows your data flows.
Under the CCPA as amended by the CPRA, a consumer has the right to direct a business to stop selling or sharing their personal information. The California Privacy Protection Agency (CPPA) issued regulations implementing that right and, along with the California Attorney General, enforces it.
The regulations are unusually direct about the link's purpose. Section 7013(a) says the point of the "Do Not Sell or Share My Personal Information" link is "to immediately effectuate the consumer's right to opt-out of sale/sharing," or else to take the consumer to a page where they can learn about and make that choice. "Effectuate" is the operative word. The link is not a notice. It is a control.
A few structural rules follow from that, and they are the ones businesses most often get backwards:
Owners hear "do not sell my data" and conclude it does not apply, because they have never sold a customer list to anyone. That reasoning skips the second verb.
The statute defines sell broadly — disclosing, disseminating, making available, or transferring personal information to a third party for monetary or other valuable consideration. It separately defines share as making personal information available to a third party for cross-context behavioral advertising, whether or not any money changes hands. Cross-context behavioral advertising means targeting ads to someone based on their activity across sites and services other than the one they are intentionally interacting with.
That definition lands squarely on ordinary ad tech. An advertising pixel that sends a page view, a product ID, and a persistent identifier to an ad platform so that platform can build an audience and retarget that person elsewhere is doing the thing the statute describes. No invoice is involved, which is exactly why the "we don't sell data" instinct fails.
The regulations close the escape hatch some businesses reach for next — labeling the ad platform a "service provider." Section 7050(b) states that "a person who contracts with a business to provide cross-context behavioral advertising is a third party and not a service provider or contractor with respect to cross-context behavioral advertising services." A vendor contract does not convert cross-context targeting into first-party processing.
If you want the fuller statutory picture — how sale and sharing are defined, what has to happen when a visitor opts out, and where sensitive personal information fits — see our overview of the California CCPA and CPRA framework.
Here is the pattern, and it is remarkably consistent:
The visitor who submitted that form reloads the page and their browser sends the same third-party requests with the same identifiers to the same ad platforms. Nothing in the pipeline changed, because nothing in the pipeline was ever connected to the form.
This is not a hypothetical failure mode. In May 2025 the CPPA ordered menswear retailer Todd Snyder to pay $345,178, finding among other things that the company was "failing to oversee and configure properly the technical infrastructure of its privacy portal, resulting in a failure to process consumer requests to opt out of the sale or sharing of personal information for 40 days," and that it required consumers to verify their identity before it would honor an opt-out. Two months earlier, in March 2025, the agency announced a $632,500 resolution with American Honda Motor Co. over, among other findings, requiring verification and excessive personal information to exercise opt-out rights and using a privacy management tool that did not present choices symmetrically. Both cases are about mechanics, not about missing links.
Three things, and they are independent — a setup can do one and fail the other two.
1. Stop the transfer going forward. Section 7026(f)(1) requires the business to cease selling to and sharing with third parties "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request." In practice that means the client-side tags that transmit identifiers to third parties must not fire for that visitor, and any server-side equivalent — conversions API calls, server-side tagging containers, warehouse-to-platform audience syncs — must stop too. A common half-fix blocks the browser pixel while a server-side integration keeps sending the same events from your backend.
2. Propagate to the platforms. The obligation does not end at your edge. Section 7026(f)(2) requires notifying all third parties to whom you sold or shared that consumer's information after the request but before you complied, directing them to comply and to forward the request onward. The platform flags below cover only the forward-looking half of this — they govern what a platform may do with data you send from now on, not data you already shared before you complied, which you have to notify third parties about separately. Ad platforms expose mechanisms for the forward-looking part — Google's consent mode parameters covering ad storage, ad user data and ad personalization, and Meta's Limited Data Use flag are the two most commonly used. Confirm the current parameter names and semantics in each platform's own documentation, since these change.
3. Persist for that user. An opt-out that survives only until the next page navigation is not an opt-out. It has to hold for the browser or device and any profile associated with it, including pseudonymous profiles (§ 7025(c)(1)). Two related traps: if the opt-out state lives only in a cookie that your own consent banner clears, it evaporates; and § 7025(c)(5) says that where the consumer is known to you, you may not treat the later absence of a signal as consent to opt back in. Section 7026(k) adds a 12-month waiting period before asking an opted-out consumer to opt back in.
This is where form-only implementations fail structurally rather than accidentally.
An opt-out preference signal is a machine-readable message the browser sends on its own. Global Privacy Control is the widely adopted implementation: per the GPC specification it travels as a request header (Sec-GPC: 1) and is exposed to page scripts as a boolean property on the navigator object. Some browsers ship it as a setting; others need an extension.
Section 7025(b) requires a business that sells or shares personal information to process any conforming signal "as a valid request to opt-out of sale/sharing," and describes the qualifying format as one "commonly used and recognized by businesses. An example would be an HTTP header field or JavaScript object." Section 7025(c)(1) says the signal must be treated as a valid request for that browser or device and any associated profile.
Two consequences catch people out. First, § 7025(e) is explicit that posting the link and honoring signals are not alternatives: "Even if the business posts the above-referenced links, the business must still process opt-out preference signals." The choice the statute offers is the reverse one — a business that processes signals frictionlessly, meeting the conditions in § 7025(f) and (g), may skip posting the links. Second, § 7026(j) provides that the signed written permission an authorized agent would otherwise need does not apply to requests made by an opt-out preference signal.
None of this can be satisfied by a form, because no human is filling anything in. Honoring GPC requires reading the header or the navigator property at the server or in a script that runs before your tags do, and gating tag execution on the result. That is an engineering change, and it is a common gap on sites that otherwise look compliant. Sephora's August 2022 settlement with the California AG — $1.2 million — included the allegation that it failed to process opt-out requests made via Global Privacy Control.
You can do this yourself with browser developer tools. Use a fresh profile or a private window each time so old state does not confuse the result.
If you would rather start with a machine-readable inventory of what loads before you go tag by tag, our free cookie and consent checker reports the tracking, analytics, ad-pixel, chat and session-replay scripts that contact third-party servers and the cookies set before any consent choice, which gives you the baseline for step 1. RegSentry can also re-scan the same page later and show you what changed between scans, and where a banner offers a decline option it reports which tracking scripts keep firing after the decline. It does not submit a Do Not Sell request or send a GPC signal on your behalf, so steps 2 through 5 still have to be run by hand.
Consent platforms and agencies vary enormously in how much of this they actually do. These questions separate the ones that have wired it up from the ones that installed a banner:
Having the link is a documentation task. Honoring the opt-out is an engineering task, and it is the one that determines whether the link means anything. The failure is easy to find — opt out, reload, watch the network tab — and hard to see from a privacy policy review, which is why it survives so long on so many sites.
This article is general information about how the CCPA/CPRA framework and the CPPA's regulations work. It is not legal advice, it does not create an attorney-client relationship, and regulations and enforcement priorities change. Verify the current text of the regulations and your own obligations with qualified counsel before acting.
The fastest way to find out whether your opt-out does anything is to watch the network log yourself, before and after. Our free checker runs a real browser against your site and shows you every tracker that fires, with the evidence.
See what fires on your site before visitors consent — free, 30 seconds, no signup.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
If you'd rather have the site watched continuously — with an email the moment a new tracker appears — that's what monitoring is for ($99/mo, cancel anytime).