Building a Do Not Sell or Share link that works

What counts as selling or sharing?

Under the CCPA as amended by the CPRA, a sale means disclosing personal information to a third party for monetary or other valuable consideration. Sharing is narrower and, for most websites, more consequential. It means disclosing personal information for cross-context behavioral advertising, and no money has to change hands, which is where most sites go wrong.

That second definition covers tools you probably already run. The retargeting tag your agency added last spring, the social advertising pixel on your checkout page and the audience script that builds lookalikes all send identifiers and browsing behavior to companies that use them to target ads elsewhere. That's cross-context behavioral advertising, so in the statutory sense a normal marketing site is sharing by default.

The sentence that comes up most often is “we don't sell anyone's data.” That's usually true and usually beside the point, because if ad tech fires on your pages, you likely owe Californians a way to stop it. The practical question is whether you can switch sharing off on request. None of this is legal advice, and your counsel gets the final word on whether your stack qualifies.

Where does the link go, and what does it say?

California expects a clear and conspicuous link titled Do Not Sell or Share My Personal Information, on the homepage and on any page where personal information is collected. The footer is the usual place for it, and that's fine. You can't bury it in paragraph nine of a privacy policy nobody scrolls through, or put it behind an account login.

California also allows a single alternative link labeled Your Privacy Choices, shown with the official opt-out icon, in place of separate sale-and-share and sensitive-data links. The icon goes alongside the words and can't stand in for them. Whichever you pick, your notice at collection has to carry the link too. The page it opens should let someone finish in a click or two, without a form, an email address or a phone tree.

Enforcement keeps coming back to symmetry, so make opting out as easy as you made opting in. Honda paid $632,500 in 2025 partly over opt-out flows that demanded more of the person opting out than of the person opting in, including identity details the request didn't need. Todd Snyder's $345,178 settlement the same year came down to a banner misconfigured so that the opt-out never really worked.

What has to happen after the click

A link that only changes something on screen doesn't do the job. The click has to reach the tags. In practice, the ad and analytics scripts covered by the request have to stop firing in that browser, and any server-side forwarding (conversions APIs, warehouse syncs, CRM pushes feeding ad audiences) has to stop carrying that person's identifiers as well. Handling only the client side is a common and expensive gap.

The request also has to reach the companies you've already sent data to. California's regulations expect businesses to act as soon as feasibly possible and no later than fifteen business days, and to notify third parties who received that person's data in the preceding ninety days so they stop too. Confirm those timelines with your own counsel. Healthline's $1.55 million settlement in 2025 turned on sharing that continued after people opted out.

The choice also has to last. An opt-out is a durable preference on that browser that outlives the session, and you shouldn't ask again for at least twelve months. Store it, re-apply it on every page load before anything else runs, and keep a record of when it happened.

• Stop the tags, client-side and server-side
• Notify downstream recipients from the last 90 days
• Persist the choice for at least 12 months

The frictionless option in section 1798.135(b)

Many sites don't know there's a second path. Section 1798.135(b) lets a business skip the posted link entirely if it processes opt-out preference signals in a frictionless manner. That means honoring Global Privacy Control automatically, without charging a fee, degrading the experience, or showing a confirmation pop-up asking whether the visitor really meant it.

Frictionless is a demanding standard, and choosing it moves the engineering work somewhere else without removing it. You still have to detect GPC on every request, apply it before any ad tech loads, and state in your privacy policy that you honor the signal. Doing both usually leaves you with less to worry about. Honor GPC and post the link anyway, because the link costs little and an argument about whether your flow was frictionless can cost a lot.

Honoring GPC is mandatory in California either way, and the obligation is spreading. As of 2026, nineteen or more comprehensive state privacy laws are in force, with Indiana, Kentucky and Rhode Island among the newer ones, and twelve states require honoring universal opt-out signals. Maryland goes further and bans the sale of sensitive data outright. Ask your counsel which of those laws reach your business, because a blog post can't tell you. Sephora's $1.2 million settlement in 2022 was, at bottom, about ignoring the signal.

How UserGuard is built to handle it

UserGuard is newly launched and doesn't have a track record yet, so read this as a description of the design. The opt-out path works like the rest of the product. GPC detection and geo-targeting are on every plan and are never held back as an upsell, because a compliance feature isn't much use if you have to pay extra to get it.

Opt-out requests are recorded as consent events tied to the site, the banner version, the region and a timestamp, and you can export them as CSV. You'll want that record when someone asks you to show what a visitor was shown and what they chose. To keep the record accurate, the scanner's evidence gate labels something a cookie only when a Set-Cookie header, an HTTP-only record, or a document.cookie value backs it. Everything else is kept as clearly labeled context.

For Google advertising and measurement, Consent Mode v2 has been required since March 2024 where EEA and UK users are covered, and UserGuard is designed to send all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. It isn't a Google-certified CMP and it isn't IAB TCF validated. TCF is on the roadmap and hasn't shipped. Pricing is $10 per site per month with automatic volume discounts (current rates), and that includes the accessibility widget.

Go deeper: the US opt-out mechanics · banner and preference-center UX