The Do Not Sell or Share link (CCPA)

The CCPA opt-out is a separate tool from the cookie banner because the regulation says it must be. Where the link renders, what it records, and why.

The CCPA opt-out and the cookie banner look similar. Both are controls a visitor uses to limit tracking. The regulation treats them differently. Under 11 CCR 7026(a)(4), a cookie control "is not by itself an acceptable method" for submitting the opt-out. A site that offers only a cookie banner has not offered the CCPA opt-out, whatever the banner says.

So UserGuard ships the Do Not Sell or Share link as its own tool. It has its own link, its own panel, and its own event record. It does not depend on the banner being on screen, and turning one off does not turn off the other.

Where the link renders — you place it

UserGuard renders the link — Do Not Sell or Share My Personal Information, the statutory wording — into markup you add where the link should live, normally your footer:

<span data-ug-do-not-sell></span>

No placeholder means no link. UserGuard deliberately never injects the link into a page on its own: a compliance link that appears wherever a script guesses your footer is belongs to nobody, breaks with the next theme change, and is exactly the kind of thing you should place once and own. Your next scan verifies the markup is present on the site, so a missing placeholder shows up as a finding rather than a silent gap.

Clicking the link opens a panel where the visitor records the opt-out.

No account is required.
No sign-in is required.
No proof of identity is required.

That is not a convenience decision. The regulation requires the opt-out to work exactly this way: any visitor, immediately, without the site first verifying who they are.

The wording is regulated too

Two details of the panel copy exist because the regulation demands them. First, the choices avoid yes/no double negatives (no "confirm you do not want to not opt out" constructions), per 7004(a)(3)(A). Second, once the request is processed, the panel displays Opt-Out Request Honored, the confirmation described in 7025(c)(6). The visitor should not have to guess whether anything happened.

Which categories count as a sale

An opt-out has to change something. You configure which script categories are treated as sale or sharing on your site. The defaults: analytics and marketing are in, functional is out.

Marketing is the obvious case. Analytics is included deliberately. The Sephora enforcement action treated the benefits a site received from its analytics provider as a "sale" under the CCPA. If your analytics arrangement is genuinely different, you can remove the category. The default assumes it is not.

Global Privacy Control and the USP string

Some visitors opt out before they ever reach your footer. Global Privacy Control is a signal the visitor's browser sends with every request. UserGuard honors it automatically as an opt-out. No click required. Honoring GPC is mandatory in California and required in twelve US states, so this is not behavior you should want to disable.

UserGuard also publishes an IAB US Privacy (USP) string, so systems that read that signal see the visitor's current opt-out state.

Twelve months, minimum

Once a visitor opts out, the opt-out is honored for at least 12 months before the banner may ask them again (11 CCR 7027(g)). UserGuard enforces the waiting period for you. An opt-out that gets re-prompted the following week is an opt-out the site is trying to wear down, and the regulation is written to prevent exactly that.

What the record looks like

Do Not Sell events are recorded distinctly from consent decisions. A rejected cookie banner and a CCPA opt-out are different legal objects, so UserGuard stores them as different records. When a regulator asks to see your opt-outs, you hand over opt-outs, not a mixed export of banner rejections you then have to explain.

That is the same principle behind the rest of the product: the record you produce should answer the question you were asked.