What the "Do Not Sell or Share" link actually does

Scroll to the bottom of almost any large retail or news site and you will find it in the footer, somewhere between the careers page and the terms of use: "Do Not Sell or Share My Personal Information." On some sites it reads "Your Privacy Choices," with a small blue toggle icon beside it. Most people never click it, and those who do often wonder whether anything happened.

The link comes from the California Consumer Privacy Act, as amended by the California Privacy Rights Act that voters approved in 2020. It does one job reasonably well and several others not at all. Below: what you will see at each step, what the law says it means, and where its edges are. This is general information, not legal advice about a particular company.

What you will see, and what it means

The link in the footer

What you see: a text link, usually in small type, sometimes with an icon.

What it means: Civil Code section 1798.135 requires a business that sells or shares Californians' personal information to put a "clear and conspicuous" link on its homepage titled "Do Not Sell or Share My Personal Information." If the business also uses sensitive personal information (precise location, account log-ins, government ID numbers, health details and similar categories) for purposes beyond providing what you asked for, it needs a second link, "Limit the Use of My Sensitive Personal Information." Section 7015 of the state's privacy regulations lets a business replace the two with a single link titled "Your Privacy Choices" or "Your California Privacy Choices," shown with a specific opt-out icon.

Not every company has to do this. The law covers for-profit businesses that do business in California and meet at least one of three tests: annual gross revenue above an inflation-adjusted threshold (26.625 million dollars since January 2025, according to the state privacy agency), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning at least half of annual revenue from selling or sharing personal information.

A site with no link at all

What you see: nothing in the footer.

What it means: not necessarily a violation. A business that neither sells nor shares personal information needs no link. And under section 1798.135(b), a business that honors browser opt-out signals in what the regulations call a "frictionless" way may leave the links off entirely. The privacy policy should tell you which route the company took, because the statute requires it to describe your opt-out rights and either link to the opt-out page or state that it responds to opt-out preference signals.

The page behind the link

What you see: usually a short form or a switch, sometimes a cookie settings panel.

What it means: section 7026 of the regulations sets the rules for this page. A business may not make you create an account, and it may not ask for more information than it needs to carry out the request. Unlike a request to see or delete your data, an opt-out does not have to be verified; if the business can act on it without more details, it must. And a cookie banner or cookie settings tool is not, on its own, an acceptable way to opt out of sale or sharing. The regulation's reasoning is precise: cookies concern collection, while the opt-out concerns what happens to your information after it is collected.

The confirmation

What you see: ideally, a message such as "Opt-Out Request Honored," or a switch in your account settings showing that you have opted out.

What it means: the regulations require a business to give you a way to confirm that it processed your request, and to display on its website whether it processed a browser opt-out signal. If nothing confirms your click, take a dated screenshot; a regulator will ask for that kind of detail.

What "sell" and "share" mean in this law

Both words carry statutory definitions in section 1798.140, and both are wider than everyday use.

To "sell" means releasing, disclosing, making available or otherwise communicating your personal information to a third party "for monetary or other valuable consideration." No cash has to change hands.

To "share" was added by the 2020 amendments. It means making your personal information available to a third party for cross-context behavioral advertising, whether or not anything of value is exchanged. Cross-context behavioral advertising, in turn, is ad targeting based on your activity across other businesses' websites, apps and services. In plain terms: the pair of boots you looked at on one site following you around five others.

So the opt-out reaches tracking pixels and ad technology that pass your browsing data to advertising companies, customer lists traded with partners, and data sold to brokers. The statute also lists what is not a sale or a share. Passing data to a service provider or contractor working for the business under a written contract (a payment processor, a delivery company, a cloud host) does not count. Neither does a disclosure you direct yourself, or a transfer of customer records when one company buys another, as long as the buyer keeps to the original promises.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

After you opt out: what the business must do

1. Stop within 15 business days at most. Under section 7026(f), the business must stop selling and sharing your information "as soon as feasibly possible," and no later than 15 business days after it receives the request. If it can stop instantly, it may not take the full 15 days.
2. Tell the companies it passed your data to in the meantime. Any third party that received your information after you asked, but before the business acted, must be told about your request and directed to comply and pass it along.
3. Leave you alone for a year. Section 1798.135(c)(4) bars the business from asking you to opt back in for at least 12 months.
4. Treat you the same. Section 1798.125 prohibits charging you more, giving you worse service or denying service because you exercised the right, although disclosed loyalty and rewards programs have their own rules.
5. Use the request data for the request only. Whatever you typed into the form may be used solely to carry out the opt-out.

For younger users, the default runs the other way. Under section 1798.120(c), a business that knows a consumer is under 16 may not sell or share that person's information at all unless a teenager aged 13 to 15 has opted in, or a parent has for a child under 13.

The browser signal: one setting instead of a hundred clicks

Clicking a footer link on every site you visit is not a realistic routine, so California's rules recognize a shortcut: an opt-out preference signal sent automatically by your browser or an extension. The best known is Global Privacy Control, or GPC.

Section 7025 of the regulations requires a business that sells or shares personal information to treat a qualifying signal as a valid opt-out request for that browser or device and for any profile linked to it. If you are signed in, the business must apply it to your account as well. Posting the footer links does not excuse a business from honoring the signal.

According to the Global Privacy Control project, Brave, the DuckDuckGo browser and Firefox support the signal, and extensions such as the Electronic Frontier Foundation's Privacy Badger add it to other browsers. In Firefox it is an option in the privacy settings that you switch on. If your browser offers no such setting, that is due to change: a new section of the law added by Assembly Bill 566 (Civil Code section 1798.136) requires every business that develops or maintains a browser to include a setting that sends an opt-out preference signal, easy for a reasonable person to find, starting January 1, 2027.

The signal has limits worth knowing. It travels with one browser on one device. If a business cannot connect that browser to you, the opt-out covers the browser and nothing else, so a mailing list built from your name and home address is out of its reach. Phone apps do not see your browser's settings at all.

Regulators have treated ignored signals as a real violation. In August 2022 the Attorney General announced a 1.2 million dollar settlement with Sephora over allegations that it did not tell customers it was selling their information and did not process GPC opt-outs. In September 2025 the California Privacy Protection Agency, which now calls itself CalPrivacy, ordered Tractor Supply to pay 1.35 million dollars, citing among other things the lack of an effective way to opt out, including through signals like GPC. The agency described it as its largest fine to that point.

What the link does not do

• It deletes nothing. Opting out stops future selling and sharing; the company keeps what it has. Deletion is a separate right under section 1798.105, requested separately. The access and deletion letter builder drafts that request for you.
• It does not stop collection, or the company's own use. A store can still record what you buy and send you its own offers. Its analytics vendor, working as a service provider, can still process your visits.
• It does not end advertising. You will still see ads. They should simply be based on the page you are reading rather than on a profile assembled from your activity elsewhere.
• It does not reach data the law exempts. Credit reports and many background checks fall under the Fair Credit Reporting Act; banks' customer data falls largely under the Gramm-Leach-Bliley Act; patient records fall under HIPAA. Information lawfully made available from government records is not "personal information" under the statute at all.
• It is not a people-search removal. Brokers that compile profiles of people they have never dealt with have their own opt-out processes, and Californians can now reach every registered broker at once through the state's deletion platform, covered in our guide to the Delete Act and DROP.
• It is a legal right only for California residents. Many national companies apply the choice to everyone, or honor GPC from any visitor, but California law does not require them to.

Privacy kit

• NordPassCreates and stores a unique password for every account.Start with NordPass

Chosen from specifications, policies and published reviews; we have not tested these ourselves. More in the Privacy kit

Similar links under other state laws

Most of the state consumer privacy laws passed since Virginia's in 2021 give residents a right to opt out of the "sale" of personal data and of "targeted advertising," which is roughly what California calls sharing, along with some forms of automated profiling. Several also require businesses to honor a browser signal. Among them: Colorado has required it since July 1, 2024, with GPC the first mechanism its Attorney General recognized; Connecticut since January 1, 2025; Oregon since January 1, 2026, where the Department of Justice adds that businesses must also keep a clear and conspicuous opt-out link on their websites.

The labels you will meet vary: "Your Privacy Choices," "Opt out of targeted advertising," "Do Not Sell My Personal Data." The definitions behind them vary too, so the same click can reach a little more or a little less depending on where you live.

A five-minute setup

• Turn on Global Privacy Control in your main browser, or add an extension that sends it.
• For the accounts that matter most (big retailers, streaming services, news subscriptions), sign in and use the link once, so the opt-out attaches to your account and not only to one browser.
• Look for the confirmation, and keep a dated screenshot.
• Set a reminder for a year from now; that is when a business may ask you to opt back in, and you can say no.
• If a business ignores you, California residents can file a complaint with CalPrivacy or the Attorney General. Elsewhere, start with your state attorney general's consumer protection office. If a dispute involves real money or a job, talk to a privacy lawyer before anything else.

Your next three steps

1. Draft an access or deletion request with the request letter builder.
2. Send it from an address you can switch off later; NordPass Email Masking does that.
3. For the bigger picture behind these laws, read The Age of Surveillance Capitalism.