Right to Opt-Out of Sale/Sharing

A CCPA/CPRA consumer right enabling individuals to direct businesses not to sell or share their personal information. Under CCPA Section 1798.120, businesses that sell personal information must provide consumers a clear 'Do Not Sell My Personal Information' link on their homepage. CPRA expanded this to include 'sharing' for cross-context behavioral advertising. Businesses must honor opt-out requests within 15 business days, refrain from selling/sharing the consumer's information unless the consumer later authorizes sales, and wait at least 12 months before requesting the consumer to reauthorize sales. For consumers under 16, businesses must obtain opt-in consent before selling/sharing (affirmative authorization for 13-15 year olds, parental consent for under 13). Organizations must recognize Universal Opt-Out Mechanisms like Global Privacy Control as valid opt-out requests. The right extends to service providers and contractors—businesses must contractually prohibit them from selling/sharing data they receive. This right fundamentally challenges data monetization business models and requires significant operational changes.