Do Not Sell or Share

Under CPRA, the combined consumer right to opt-out of both the sale of personal information and the sharing of personal information for cross-context behavioral advertising. This expansion recognizes that data monetization occurs not just through direct sale but also through sharing for targeted advertising purposes. The 'Do Not Sell or Share' link must appear conspicuously on websites, allowing users to opt-out with minimal friction. Businesses must honor opt-out requests within 15 business days, instruct service providers and contractors not to sell or share the data, wait 12 months before requesting opt-in, and not discriminate against users who opt-out. Organizations should implement systems to respect opt-out signals, maintain opt-out lists, train staff on proper handling, and monitor compliance. The combined right reflects understanding that selling and sharing for advertising purposes both commoditize personal information in ways individuals should control.