Section: Privacy · Last updated: October 27, 2026
This guide is based on the CCPA Regulations, California Code of Regulations, title 11, sections 7025 and 7026, in the version effective January 1, 2026 published by the California Privacy Protection Agency, and on California Civil Code sections 1798.120, 1798.135 and 1798.140. The description of Global Privacy Control comes from the W3C GPC specification. It is general information, not legal advice.
California gives consumers the right to tell a business not to sell or share their personal information. You can do it by clicking a link on each site, or by turning on a browser signal that says the same thing to every site at once. The state’s regulations treat that signal as a real opt-out request, and since January 1, 2026 they require businesses to show you that they honored it. This guide goes through what the regulation text says.
1. The rule at a glance
| Question | What the regulations say |
|---|---|
| Browser signal | A business that sells or shares personal information must treat a qualifying opt-out preference signal as a valid request to opt out (7025(b)) |
| Deadline | Stop selling and sharing as soon as feasibly possible, and no later than 15 business days after receiving the request (7026(f)(1)) |
| Proof it worked | The business must display whether it processed your signal, for example “Opt-Out Request Honored” (7025(c)(6), 7026(g)) |
| What you can be asked for | No account, and no information beyond what is needed to carry out the request (7026(c)) |
| Cookie banners | A cookie banner or cookie controls alone is not an acceptable way to opt out of sale or sharing (7026(a)(4)) |
| Asking you again | Wait at least 12 months before asking you to consent to sale or sharing again (7026(k)) |
2. What “sell” and “share” cover, and which businesses
Under Civil Code 1798.140, sharing means making a consumer’s personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands. That is the kind of ad targeting that follows you from site to site. Selling covers disclosure for money or other valuable consideration. The right to opt out of both comes from Civil Code 1798.120(a).
The rules apply to a for-profit “business” that does business in California and meets at least one of these thresholds:
- Annual gross revenue above a set amount in the preceding calendar year. The statute says $25,000,000, adjusted for inflation; the agency’s current figure, effective January 1, 2025, is $26,625,000.
- Buys, sells or shares the personal information of 100,000 or more consumers or households a year.
- Derives 50 percent or more of its annual revenue from selling or sharing personal information.
3. What counts as an opt-out preference signal
Section 7025(b) sets two conditions. The signal must be in a format commonly used and recognized by businesses, and the regulation gives an HTTP header field or a JavaScript object as examples. The tool that sends it must make clear, in its settings or public disclosures, that using it is meant to opt you out of sale and sharing. That disclosure does not have to mention California.
The regulation does not name a specific product. Global Privacy Control (GPC) is a signal built in this form. The W3C specification defines a Sec-GPC header sent with web requests and a navigator.globalPrivacyControl property that scripts on a page can read. The GPC project states that the signal is intended to communicate a Do Not Sell or Share request under the CCPA, and that it is available in several browsers and extensions.
4. What a business must do when it receives the signal
| Situation | Section 7025(c) |
|---|---|
| You are not logged in | The opt-out applies to that browser or device and any profile linked to it, including pseudonymous profiles |
| The business knows who you are | It must also apply the opt-out to you as a consumer, such as your account |
| Your account settings allow sale or sharing | The signal wins. The business may tell you about the conflict and ask for consent, but must process the opt-out unless you consent |
| You are in a loyalty or reward program that depends on sharing | The business may ask whether you want to leave the program. If it does not ask, it must still process the signal for that browser or device |
| You later visit without the signal | If you are known to the business, it may not treat the missing signal as consent to sell or share |
The business may not require more information than is needed to send the signal (7025(c)(2)). It may offer you a chance to give more, for example so the opt-out can reach offline sales, but if you do not respond it must still honor the signal for that browser or device. Information collected in sending or processing the signal may not be used for any other purpose (7025(d)).
The regulation’s own example: a visitor who is not logged in and cannot be linked to an account gets the opt-out applied to their browser identifier, but not to their account, because the business does not know the two are connected.
5. Opting out without the signal
A business that sells or shares personal information must offer two or more ways to opt out, and at least one must match how it mainly deals with you (7026(a)). A business that collects information online must accept the browser signal plus at least one other method, such as an interactive form behind a “Do Not Sell or Share My Personal Information” link. Other accepted methods include a toll-free number, an email address, or a form submitted in person or by mail.
- No identity check. A business may not require a verifiable consumer request to opt out. It may ask only for what it needs to find whose information to stop selling, and if it can comply without more, it must (7026(d)).
- Fraud. A business may deny a request only with a good-faith, reasonable and documented belief that it is fraudulent, and must tell you why (7026(e)).
- All or nothing option. It may offer choices by type of use, but must also offer a single option to opt out of all sale and sharing (7026(h)).
- Authorized agents. Someone can submit the request for you with your signed written permission. That permission is not required for requests made by a browser signal (7026(j)).
6. How fast the business must act
- Stop selling and sharing. As soon as feasibly possible, and no later than 15 business days from receipt (7026(f)(1)). The 2026 text adds an example: a website that sells data through real-time ad bidding and can cut it off instantly must stop immediately, not take 15 business days.
- Tell the third parties. If your information was sold or shared after you asked but before the business complied, it must notify those third parties, direct them to comply, and have them pass the request on (7026(f)(2)).
- Show you the result. The business must provide a way to confirm your request was processed, for example an “Opt-Out Request Honored” message and a toggle in your privacy settings (7026(g)).
7. Why some sites have no “Do Not Sell” link
Civil Code 1798.135 gives a business a choice. It can post the “Do Not Sell or Share My Personal Information” link (or an alternative opt-out link) and still honor browser signals, or it can honor signals in a frictionless manner and skip the link. Section 7025(e) states that posting the link never removes the duty to process signals.
Frictionless, under 7025(f), means the business does not charge a fee, does not change how its product works for you, and does not show a pop-up, banner or other interstitial in response to the signal. Displaying your opt-out status is allowed. To skip the link, the business must also explain in its privacy policy that it processes signals this way, and the signal must fully carry out your opt-out. A business that also sells data offline and would need more information from you cannot use this route (7025(g)).
FAQ
Q. I turned on GPC. Do I still need to click each site’s link?
Under section 7025, a qualifying signal is itself a valid opt-out for that browser or device. Clicking a link or logging in can extend it to your account, which the signal alone may not reach when the business cannot connect your browser to you.
Q. A cookie banner let me reject cookies. Is that the same as opting out?
Not under section 7026(a)(4). The regulation says cookie controls concern collection, not sale or sharing, so they do not count on their own as an opt-out method.
Q. How do I know a site honored my signal?
Since January 1, 2026, the regulations say the business must display whether it processed the signal. Look for a message such as “Opt-Out Request Honored” or a setting showing you are opted out.
Q. Can a site keep asking me to opt back in?
Section 7026(k) requires a business to wait at least 12 months after your request before asking you to consent to sale or sharing again, except where the regulations allow it.
Official sources
- California Code of Regulations, title 11, § 7025 — Opt-out Preference Signals (CCPA Regulations effective January 1, 2026, California Privacy Protection Agency)
- California Code of Regulations, title 11, § 7026 — Requests to Opt-out of Sale/Sharing (same version)
- California Civil Code §§ 1798.120, 1798.135 and 1798.140 — California Consumer Privacy Act
- California Privacy Protection Agency — Updated Monetary Thresholds in CCPA, effective January 1, 2025
- W3C Global Privacy Control specification — Sec-GPC header and globalPrivacyControl property
This article is general information based on the regulation and statute text. It does not cover the right to limit use of sensitive personal information, rules for minors under 16, or other states’ privacy laws. For a specific problem, you can file a complaint with the California Privacy Protection Agency.