"Do Not Sell My Personal Information": What the Link Means and When You Need One

A “Do Not Sell or Share My Personal Information” link enables California consumers to opt out of having their personal information sold or shared with third parties. This guide explains when these links are required under the CCPA, how to add the link and notice to your website, and how to handle opt-out requests and Global Privacy Control (GPC) signals.

You may have seen a “Do Not Sell or Share My Personal Information” link, likely in a website footer. If you run a website with visitors from California, your website may need one too.

The link originates from the California Consumer Privacy Act (CCPA), which required a "Do Not Sell My Personal Information" link. When the California Privacy Rights Act (CPRA) amendments to CCPA took effect on January 1, 2023, the wording expanded to "Do Not Sell or Share My Personal Information." Businesses may alternatively use a single "Your Privacy Choices" link with the approved opt-out icon.

The link enables California consumers to opt out of certain sales or sharing of their personal information. Selling doesn’t necessarily mean exchanging that information for money. Some uses of advertising and tracking technologies can also fall within the CCPA’s definitions of selling or sharing.

That doesn’t mean every website needs a “Do Not Sell or Share My Personal Information” link. It depends on whether the CCPA applies to your business and how you use consumers’ personal information. This guide explains when you may need a “Do Not Sell or Share My Personal Information” link, what it needs to do, and how to provide the right opt-out on your website.

What Does "Do Not Sell My Personal Information" Mean?

A “Do Not Sell or Share My Personal Information” link gives consumers a way to tell a business that they want to opt out of the sale or sharing of their personal information. 

U.S. state privacy laws generally use an opt-out model for handling most personal information, meaning businesses typically don't need prior consent to collect and use it. Consumers must still be able to opt out of its sale or sharing at any time.

Under the CCPA, personal information (PI) is broadly defined as information that can reasonably be linked to a person or household. That can include information collected through cookies, tracking pixels, and other technologies, even when it doesn’t directly identify someone by name.

For example, third-party advertising technologies on your website may collect information about a visitor’s activity and send it to another company. Depending on what happens to that data, the CCPA may consider this a sale or sharing of personal information. 

If the CCPA applies to your business and you sell or share PI, you generally need to give consumers a way to opt out, which can include a “Do Not Sell or Share My Personal Information” link.

What Is Correct: “Do Not Sell” or “Do Not Sell or Share”?

You may have seen websites use either “Do Not Sell My Personal Information” or “Do Not Sell or Share My Personal Information.” The difference comes from a change to California privacy law. 

The original CCPA gave consumers the right to opt out of the sale of their personal information. When the CPRA amended the CCPA, it expanded this right to include certain types of sharing.

Under the CCPA, “sharing” has a specific meaning. It refers to sharing personal information for cross-context behavioral advertising, such as using information about someone’s activity across different websites, apps, or services to show them targeted ads. This means your business may have opt-out obligations even if it doesn’t sell personal information.

That’s why you’ll now commonly see “Do Not Sell or Share My Personal Information.” Businesses subject to the CCPA use this link to give consumers a way to opt out of the sale or sharing of their personal information.

Does My Website Need a "Do Not Sell or Share My Personal Information" Link?

Not every website needs a “Do Not Sell or Share My Personal Information” link. Whether yours does depends on whether the CCPA applies to your business and whether you sell or share consumers’ personal information.

To find out, work through these two steps. 

Step 1: Is Your Business Subject to the CCPA?

Having visitors from California doesn’t automatically mean the CCPA applies to your business. But you don’t need to be based in California, or even in the U.S., to fall within its scope.

The CCPA generally applies to for-profit businesses that do business in California and meet at least one of these thresholds: 

• Have an annual gross revenue exceeding USD 26,625,000
• Buy, sell, or share the personal information of 100,000 or more California consumers or households 
• Derive 50 percent or more of their annual revenue from selling or sharing California consumers’ personal information

The revenue requirement is adjusted for inflation every other year, with the next adjustment due in January 2027. Non-profit organizations and government agencies are generally excluded from CCPA requirements. 

Step 2: Do Your Data Practices Require an Opt-Out?

If the CCPA applies to your business, you then need to determine whether you sell or share consumers’ personal information. If you do, you generally need to give them a way to opt out.

This isn’t always as obvious as it sounds. Selling personal information doesn’t only mean exchanging it for money, and sharing can include certain uses of personal information for cross-context behavioral advertising.

That means some of the cookies, pixel trackers, and advertising technologies used on your website could trigger an opt-out requirement, even if you don’t think of your business as selling personal information.

What Counts as Selling or Sharing Personal Information?

The CCPA defines selling and sharing broadly. Whether personal information is being sold or shared depends on what happens to the data after it’s collected, including who receives it and how they use it. The CCPA distinguishes between selling and sharing based on those circumstances.

What Does "Selling" Personal Information Mean?

Under the CCPA, in addition to an exchange for money, selling personal information can include disclosing or transferring personal information to another business or third party in exchange for something else of value.

This can include personal information communicated orally, in writing, electronically, or by other means. So when assessing whether your business sells personal information, you need to look beyond direct financial transactions.

What Does "Sharing" Personal Information Mean?

Under the CCPA, sharing refers to making personal information available to a third party for cross-context behavioral advertising, whether or not money or anything else of value is exchanged.

To determine whether your business shares personal information, look at how data moves through your website. Advertising pixels, cookies, and other third-party tracking technologies may send visitor data to other companies. 

Using third-party platforms for behavioral advertising, audience building, or retargeting may also involve sharing. Understanding who receives the data and what they use it for can help you determine whether you need to provide an opt-out.

Where and How Should You Display a "Do Not Sell or Share My Personal Information" Link?

If you need to provide a “Do Not Sell or Share My Personal Information” link, consumers should be able to find it easily and use it to exercise their opt-out rights. The link should take them directly to the mechanism where they can submit their request.

Here’s what to consider when adding the link to your website.

Where to Place the Link

The CCPA generally requires the link to appear clearly and prominently on your website’s homepage. It should also remain easy for consumers to find when navigating your site.

A common way to provide consistent access is to include the link in your website footer, so it appears across your site rather than on a single page. You can also make the opt-out available through your privacy controls or consent management interface.

Your privacy policy should explain consumers’ right to opt out and how they can exercise it.

What the Link Should Say

The standard wording is “Do Not Sell or Share My Personal Information.” However, businesses that need to provide both this opt-out and the right to limit the use or disclosure of sensitive personal information can use a single “Your Privacy Choices” or “Your California Privacy Choices” link instead.

When using this alternative, the link must be accompanied by the prescribed opt-out icon.

Where the Link Should Lead to

The link should take consumers directly to a way to exercise their opt-out right. They shouldn’t have to search through your website or privacy policy to find out how to submit the request.

Keep the process clear and straightforward. Explain what the consumer is opting out of and provide the controls they need to make their choice without unnecessary steps.

What Happens When Someone Opts Out?

Providing an opt-out link is only part of the requirement. When a consumer uses it, your business needs to act on their choice. Companies must process opt-out requests as soon as feasibly possible, and no later than 15 business days after receiving them.

Once the opt-out takes effect, you must stop selling or sharing that consumer’s personal information. You may also need to notify third parties that received the information and instruct them to comply with the request. Keep a record of the consumer’s preference so it continues to be respected.

For websites, that also means making sure relevant advertising and tracking technologies respond to the opt-out. To do that, you need to know which cookies and trackers are active on your site, what data they collect, and whether they sell or share personal information with third parties.

Importantly, opt-out requests don’t always come through the “Do Not Sell or Share” link. Covered businesses must also recognize qualifying opt-out preference signals, such as Global Privacy Control (GPC). However the request reaches you, your systems need to recognize the consumer’s choice and apply it, which brings us to how GPC works.

How Does Global Privacy Control Affect "Do Not Sell or Share" Requests? 

Not every visitor will communicate their preferences by clicking the “Do Not Sell or Share” link on your website. Under the CCPA, businesses must also recognize opt-out preference signals that communicate a consumer’s choice automatically.

One common method is Global Privacy Control (GPC) to communicate their preference. GPC enables consumers to set their preferences in their web browser, either with built-in controls or via a plugin. Then the browser automatically communicates an opt-out signal with those preferences so individuals don’t have to make the same choice separately on every website they visit.

As of 2026, 12 states require businesses to honor universal opt-out mechanisms. Colorado's Attorney General has formally designated GPC as a qualifying signal, and California's regulations require businesses to honor opt-out preference signals.

If your website receives a valid GPC signal, you need to recognize and apply it. That means stopping any sale or sharing of personal information covered by the consumer’s opt-out, just as you would if they made the request through your website.

California's Opt Me Out Act will make these signals far more common. Effective January 1, 2027, it requires every web browser offered in California to include a setting that enables consumers to send an opt-out preference signal, and browser developers must explain clearly how the signal works and what it does. 

The obligation falls on browser makers, not on your business, but the practical effect is that more visitors will arrive with a signal already switched on. Your duty to honor it does not change, so it is worth confirming now that your website detects and applies these signals reliably.

Under California's CCPA regulations, businesses must also visibly confirm to the consumer that an opt-out preference signal has been processed, for example with a message such as "Opt-Out Request Honored."

Does the GDPR Require a "Do Not Sell My Personal Information" Link?

No, you do not need a “Do Not Sell or Share My Personal Information” link under the EU’s General Data Protection Regulation (GDPR). The “Do Not Sell or Share My Personal Information” link and notice are specifically associated with California’s CCPA requirements.

Regulatory frameworks, like the GDPR, use different means to uphold data privacy rights. The GDPR takes a different approach to data protection. 

Rather than giving people a specific right to opt out of the “sale” or “sharing” of personal information, it requires businesses to have a valid legal basis for processing personal data and gives individuals a range of rights over how their data is used. Prior, active consent is one of those legal bases.

If your website serves visitors in both California and the EU, you may need to provide different privacy choices depending on which rules apply. A “Do Not Sell or Share” link can help meet CCPA requirements, but it doesn’t replace the consent and other privacy mechanisms you may need under the GDPR.

How Cookiebot Can Make CCPA Opt-Outs Easier to Manage

If the CCPA applies to your business and you sell or share personal information, providing an opt-out is more than adding a “Do Not Sell or Share My Personal Information” link. You also need to recognize consumers’ choices and make sure the relevant data sharing stops when they opt out.

This can become difficult to manage when your website uses multiple cookies, trackers, and third-party services. A consent management platform (CMP) can help by bringing these technologies and your visitors’ privacy choices together in one place.

Cookiebot™ CMP by Usercentrics scans your website to identify cookies and tracking technologies and helps you manage the privacy choices available to visitors. It geotargets visitors to present the right consent experience, such as opt-in or opt-out requirements for different jurisdictions worldwide. It also honors opt-out signals like GPC and communicates privacy choices to supported third-party technologies so they can be applied across your website and tracking infrastructure.