The Do Not Sell or Share link (CCPA)

The CCPA opt-out is a separate tool from the cookie banner because the regulation says it must be. This article covers where the link renders, what it records, and why.

Because the regulation treats the opt-out and the banner differently. The CCPA opt-out and the cookie banner look similar, and both are controls a visitor uses to limit tracking, but under 11 CCR 7026(a)(4), a cookie control "is not by itself an acceptable method" for submitting the opt-out. A site that offers only a cookie banner hasn't offered the CCPA opt-out, whatever the banner says.

So UserGuard ships Do Not Sell or Share as its own tool, with its own link, its own panel, and its own event record. It doesn't depend on the banner being on screen, and turning one off doesn't turn off the other.

Placing the link

UserGuard renders the link, using the statutory wording Do Not Sell or Share My Personal Information, into markup you add where the link should go, normally your footer:

<span data-ug-do-not-sell></span>

If there's no placeholder, there's no link. UserGuard never injects the link into a page on its own. A script would have to guess where your footer is, and a compliance link placed that way breaks with the next theme change. You should place it once and own it. Your next scan verifies the markup is present on the site, so a missing placeholder shows up as a finding.

Clicking the link opens a panel where the visitor records the opt-out.

No account is required.
No sign-in is required.
No proof of identity is required.

The regulation requires the opt-out to work exactly this way, for any visitor, immediately, without the site first verifying who they are.

Regulated wording

The regulation dictates two details of the panel copy. First, the choices avoid yes/no double negatives (no "confirm you do not want to not opt out" constructions), per 7004(a)(3)(A). Second, once the request is processed, the panel displays Opt-Out Request Honored, the confirmation described in 7025(c)(6), so the visitor doesn't have to guess whether anything happened.

Which categories count as a sale

An opt-out has to change something, so you configure which script categories are treated as sale or sharing on your site. By default, analytics and marketing are included and functional isn't.

Marketing is the obvious case. We include analytics because the Sephora enforcement action treated the benefits a site received from its analytics provider as a "sale" under the CCPA. If your analytics arrangement is different, you can remove the category, but the default assumes it isn't.

Global Privacy Control and the USP string

Some visitors opt out before they ever reach your footer. Global Privacy Control is a signal the visitor's browser sends with every request, and UserGuard honors it automatically as an opt-out, with no click required. Honoring GPC is mandatory in California and required in twelve US states, so this isn't something you should want to disable.

UserGuard also publishes an IAB US Privacy (USP) string, so systems that read that signal see the visitor's current opt-out state.

How long does an opt-out last?

Once a visitor opts out, the opt-out is honored for at least 12 months before the banner may ask them again (11 CCR 7027(g)), and UserGuard enforces that waiting period for you. The regulation is written to stop sites from wearing down an opt-out by asking again the following week.

What the record looks like

Do Not Sell events are recorded distinctly from consent decisions. A rejected cookie banner and a CCPA opt-out are different legal objects, so UserGuard stores them as different records. When a regulator asks to see your opt-outs, you can hand over just the opt-outs, without a mix of banner rejections you'd then have to explain.

The rest of the product takes the same approach, with records meant to answer the question you were asked.