Building a Do Not Sell or Share link that works

What counts as selling or sharing

Start with the vocabulary, because the vocabulary is where most sites go wrong. Under the CCPA as amended by the CPRA, a sale means disclosing personal information to a third party for monetary or other valuable consideration. Sharing is narrower and, for most websites, more consequential: disclosing personal information for cross-context behavioral advertising. No money has to change hands.

That second definition sweeps in equipment you already run. The retargeting tag your agency dropped in last spring, the social advertising pixel on your checkout page, the audience script that builds lookalikes — all of them hand identifiers and browsing behavior to companies that use them to target ads elsewhere. That is cross-context behavioral advertising, spelled plainly. Sharing, in the statutory sense, is the default state of a normal marketing site.

So the sentence that comes up most often — “we don't sell anyone's data” — is usually true and usually beside the point. If ad tech fires on your pages, you likely owe Californians a way to stop it. None of this is legal advice, and your counsel gets the final word on whether your stack qualifies. The practical question is not whether you sell. It is whether you can switch sharing off on request.

Where the link goes and what it says

California expects a clear and conspicuous link titled Do Not Sell or Share My Personal Information, on the homepage and on any page where personal information is collected. The footer is the conventional home for it, and the footer is fine. What is not fine is burying it in paragraph nine of a privacy policy nobody scrolls, or gating it behind an account login.

California also allows a single alternative link labeled Your Privacy Choices, shown with the official opt-out icon, in place of posting separate sale-and-share and sensitive-data links. The icon supplements the words; it does not replace them. Whichever you pick, your notice at collection has to carry the link too, and the destination should let someone finish the job in a click or two, not a form, not an email address, not a phone tree.

Symmetry is the part enforcement keeps landing on. Honda paid $632,500 in 2025 partly over opt-out flows that demanded more of the person opting out than of the person opting in, including identity details the request did not need. Todd Snyder's $345,178 settlement the same year came down to a banner misconfigured so the opt-out never really worked. Design the exit the way you designed the entrance.

What has to happen after the click

A link that flips a UI state and nothing else is theater. The click has to reach the tags. In practice that means the ad and analytics scripts covered by the request stop firing in that browser, and any server-side forwarding — conversions APIs, warehouse syncs, CRM pushes feeding ad audiences — stops carrying that person's identifiers as well. Client-side only is a common and expensive gap.

It also has to reach the people you already sent data to. California's regulations expect businesses to act as soon as feasibly possible and no later than fifteen business days, and to notify third parties who received that person's data in the preceding ninety days so they stop too — timelines worth confirming with your own counsel. Healthline's $1.55 million settlement in 2025 turned on sharing that continued after people opted out.

Then it has to stick. An opt-out is a durable preference on that browser, not a session flag, and you should not re-ask for at least twelve months. Store it, re-apply it on every page load before anything else runs, and keep a record of when it happened.

• Stop the tags, client-side and server-side
• Notify downstream recipients from the last 90 days
• Persist the choice for at least 12 months

The frictionless option in section 1798.135(b)

There is a second path many sites do not know about. Section 1798.135(b) lets a business skip the posted link entirely if it processes opt-out preference signals in a frictionless manner — honoring Global Privacy Control automatically, without charging a fee, degrading the experience, or throwing up a confirmation pop-up asking whether the visitor really meant it.

Frictionless is a demanding standard, and choosing it does not remove the engineering work; it relocates it. You still have to detect GPC on every request, apply it before any ad tech loads, and state in your privacy policy that you honor the signal. Doing both is usually the calmer choice: honor GPC and post the link anyway, because the link is cheap and an argument about whether your flow was frictionless is not.

Honoring GPC is mandatory in California either way, and the obligation is spreading. As of 2026, nineteen or more comprehensive state privacy laws are in force — Indiana, Kentucky and Rhode Island among the newer ones, and twelve states require honoring universal opt-out signals. Maryland goes further and bans the sale of sensitive data outright. Which of those laws reaches your business is a question for counsel, not a blog post. Sephora's $1.2 million settlement in 2022 was, at bottom, about ignoring the signal.

How UserGuard is built to handle it

UserGuard is newly launched, so read this as a description of design rather than a track record. The opt-out path follows the same rule as the rest of the product: GPC detection and geo-targeting are on every plan and never held back as an upsell, because a compliance feature behind a paywall is not much of a feature.

Opt-out requests are recorded as consent events tied to the site, the banner version, the region and a timestamp, exportable as CSV — the sort of record you want when someone asks you to show what a visitor was shown and what they chose. The scanner's evidence gate keeps that record honest: something is labeled a cookie only when a Set-Cookie header, an HTTP-only record, or a document.cookie value backs it. Everything else is kept as clearly labeled context.

For Google advertising and measurement, Consent Mode v2 has been required since March 2024 where EEA and UK users are covered, and UserGuard is designed to emit all four signals: ad_storage, analytics_storage, ad_user_data, ad_personalization. It is not a Google-certified CMP and is not IAB TCF validated — TCF is roadmap, not shipped. Pricing is $10 per site per month with automatic volume discounts (current rates), accessibility widget included.

Go deeper: the US opt-out mechanics · banner and preference-center UX