A ‘Do Not Sell My Personal Information’ link in your footer is not a compliance guarantee. This CCPA-mandated link must trigger a process that stops ad pixels from sharing user data. If a visitor opts out but your website still sends data to ad networks, the link exposes your organization to regulatory action.
Many US website teams assume displaying the link satisfies their duty. The California Privacy Protection Agency (CPPA), however, focuses on technical execution. This article examines what the law requires and explains how to connect opt-out requests to real-time script blocking for genuine compliance.
What are the legal requirements for the ‘do not sell’ link?
The “Do Not Sell My Personal Information” link is a direct mandate from California’s privacy laws. It is a consumer’s primary tool to stop businesses from selling or sharing their data. Correct implementation depends on understanding this legal foundation.
Statutory scope under California law
The requirement originates in the CCPA, and the California Privacy Rights Act (CPRA) expanded it. Specifically, California Civil Code § 1798.135 obligates businesses to provide this link. Any business that sells or shares personal information must show a “clear and conspicuous link” on its homepage titled “Do Not Sell or Share My Personal Information.” This provides a direct path for consumers to submit an opt-out request. The law is not just about having a link; it demands an effective mechanism. This requirement is a core part of the California Privacy Rights Act requirements and a fundamental piece of what a CCPA-compliant website looks like to regulators.
Broad definitions of sale and sharing
A common mistake is interpreting “sale” too narrowly. Many assume it only applies to direct monetary transactions. California Civil Code § 1798.140 defines “sale” as disclosing personal information for monetary or “other valuable consideration.” This broad language includes using third-party cookies and trackers for targeted advertising. When your website sends a user’s browsing activity to an ad network, that exchange constitutes a “sale.” The CPRA added the term “sharing,” which specifically covers disclosing personal information for cross-context behavioral advertising. This leaves no room for ambiguity.
Why is displaying the link only half the battle?
A functional opt-out mechanism requires a direct connection between the user’s choice and the technology that deploys trackers. Adding a link to the footer without this integration creates a facade of compliance while the underlying data sharing continues unabated.
Opt-out signals versus tag manager execution
When a user clicks the “Do Not Sell” link, your website must translate that action into a command that prevents tracking scripts from loading. Typically, your website must send the opt-out preference to your Google Tag Manager (GTM) or a similar system. The tag manager should use this signal as a blocking trigger. This stops tags associated with platforms like Meta, Google Ads or LinkedIn from firing. If this connection is missing, the GTM container will execute these tags on subsequent page loads, rendering the user’s choice ineffective.
Common CMP misconfigurations in opt-out flows
Companies often use Consent Management Platforms (CMPs) to manage these preferences, but they can also be a point of failure. We see misconfigured CMPs, including setups with OneTrust, that fail to work correctly. They may record the opt-out choice in local storage but do not pass that signal to the tag manager. The CMP’s interface shows it saved the preference, yet the ad tags keep running because developers never configured them to listen for the opt-out signal. Properly verifying that its signals actually control tag execution involves confirming the CMP’s signals control tags, not just update an internal state.
How do CCPA opt-out and GDPR opt-in differ?
The US approach to user privacy differs fundamentally from the framework in the European Union. Businesses operating in both jurisdictions must understand this distinction. The technical compliance architecture is not interchangeable.
How US opt-out differs from European opt-in
Under the CCPA, websites can legally deploy tracking cookies and share data by default. The burden is on the consumer to find the “Do Not Sell” link and actively opt out. This is an opt-out model. In contrast, the GDPR enforces an opt-in model. In the EU, websites cannot load non-essential cookies or trackers until the user gives explicit consent, which usually happens by clicking “Accept” on a cookie banner. These CCPA vs GDPR website compliance differences mean a compliant US setup is non-compliant in the EU, and vice versa.
Managing Global Privacy Control signals automatically
California law requires businesses to honor browser-based opt-out signals. The most notable is the Global Privacy Control (GPC). GPC is a setting users can enable in their browser or via an extension that automatically broadcasts their request to opt out of tracking. Websites must detect this signal and treat it as a valid “Do Not Sell or Share” request without requiring the user to click the footer link. This means your CMP and tag management logic must recognize the GPC signal on page load and suppress relevant trackers immediately.
How can you verify your opt-out link works?
The only way to ensure your opt-out mechanism works is to test it. A legal review is not enough. Compliance lives in the network requests your website makes. Privacy officers and web engineers must work together to audit the front-end behavior to confirm your website respects a user’s choice.
- Inspect network requests upon opt-out. Use your browser’s developer tools to perform this check. Open the “Network” tab, then visit your website and click the “Do Not Sell” link. After opting out, clear your cookies and refresh the page. Watch the network requests that your browser makes. If you still see traffic to `google-analytics.com`, `connect.facebook.net`, or other ad domains, your opt-out is not working. These requests are definitive proof that data sharing is still occurring. You can find a complete methodology in our technical guide to third-party tracker detection.
- Test container triggers across ad networks. Beyond network requests, use GTM’s preview mode or similar tools to see which tags fire. After opting out on the live website, load a page using the preview tool. It should show that the triggers for your marketing tags did not activate. If tags for Google Ads remarketing, Meta Pixel, or LinkedIn Insight are still firing, the blocking rule is misconfigured or missing. This test provides a direct view into the logic that controls your data sharing.
A “Do Not Sell My Personal Information” link is an operational trigger, not a passive legal disclaimer. If clicking the link does not suppress requests to marketing tags, your website remains exposed to enforcement actions. Auditing your front-end script behavior is the only reliable way to confirm compliance. If you are not sure whether your website’s opt-out process is technically sound, you can verify your consent setup with Nixon Pro to get a clear picture of what data is being shared.
Frequently Asked Questions (FAQ)
What does a Do Not Sell My Personal Information link actually do?
A 'Do Not Sell My Personal Information' link should trigger a technical process that stops a website from sharing or selling a user's data with third parties. This specifically includes preventing advertising trackers, like those from Google or Meta, from sending a user's browsing activity to ad networks for targeted advertising. It is not just a disclaimer; it is an active control that must be wired into the website's tag management system to be effective and compliant.
Does every US website need a Do Not Sell link in the footer?
Not every US website needs this link. The requirement applies to for-profit businesses that meet certain thresholds under the California Consumer Privacy Act (CCPA) and operate in California. These thresholds include having an annual gross revenue over $25 million, processing the data of 100,000 or more consumers, or deriving 50% or more of annual revenue from selling or sharing consumers' personal information. Similar requirements exist in other states like Colorado and Virginia.
What is the difference between Do Not Sell and Do Not Share under California law?
Under California law, 'sell' refers to disclosing personal information to a third party for monetary or other valuable consideration. 'Share' was added by the CPRA to specifically cover the disclosure of personal information for cross-context behavioral advertising, even if no money changes hands. The combined 'Do Not Sell or Share' link gives consumers the right to opt out of both types of data transfers, clarifying that the use of third-party ad trackers is covered.
Why do ad trackers keep running after a user clicks Do Not Sell?
Ad trackers often keep running because the website has a technical gap between the front-end link and the back-end script management. Clicking the link might save a preference in the browser, but if this preference signal is not correctly configured to create a blocking rule in Google Tag Manager or another system, the tracking scripts will continue to fire on subsequent page loads. This is a common compliance failure due to misconfiguration.
Do browser signals like Global Privacy Control count as a Do Not Sell request?
Yes. Under the California Privacy Rights Act (CPRA), websites are required to recognize and honor Global Privacy Control (GPC) signals as a valid 'Do Not Sell or Share' request. This means businesses must have systems in place to automatically detect the GPC signal from a user's browser and apply the opt-out preference without requiring the user to manually click the footer link. Treating GPC as a valid request is a mandatory part of compliance.
