CCPA and CPRA Opt-Out Obligations: What the Law Actually Requires
Updated 2026-08-05 · 4 enforcement actions cited · 5 official sources
The California Consumer Privacy Act, as amended by the CPRA, gives every California consumer the right to direct a business to stop selling or sharing their personal information. The obligations that flow from that right are specific, mechanical, and easy to get wrong — and the regulator has now shown it will fine businesses for getting them wrong.
TL;DR
- If you sell or share personal information you must provide a clear 'Do Not Sell or Share My Personal Information' link, and generally at least two methods for submitting opt-out requests.
- Honoring an opt-out preference signal such as GPC satisfies part of that obligation and is mandatory under 11 CCR § 7025 regardless.
- You cannot verify identity as a precondition to an opt-out request, and you cannot require an account.
- You must notify third parties to whom you sold or shared the data within 15 business days and direct them to stop.
See whether your own site honors GPC. $99, runs in a real California browser.
The definitions that put you in scope
'Sell' under the CCPA means disclosing personal information to a third party for monetary or other valuable consideration. 'Share' means disclosing it to a third party for cross-context behavioral advertising, whether or not for consideration. The second definition, added by the CPRA, is what pulls ordinary advertising technology into scope: loading a Meta Pixel or a TikTok Pixel that receives your visitor's identifiers and browsing behavior for ad targeting is a 'share'.
'Personal information' is similarly broad and expressly includes device identifiers, IP addresses, cookie IDs, and inferences drawn from browsing behavior. You do not need a name or an email address for the data to be in scope.
The opt-out link and the two-method rule
A business that sells or shares must provide a conspicuous link titled 'Do Not Sell or Share My Personal Information' on its homepage, or on all pages where personal information is collected. Businesses may instead use a single, clearly labeled 'Your Privacy Choices' link with the standard opt-out icon.
The regulations require that consumers be given at least two designated methods for submitting requests to opt out, reflecting the ways the business primarily interacts with consumers. For an online-only business, an interactive form plus honoring the opt-out preference signal will generally satisfy this — and a business that processes GPC in a frictionless manner may be relieved of the separate link requirement in some configurations, though most businesses keep the link anyway.
No verification, no friction
Unlike deletion and access requests, an opt-out request may not be conditioned on verifying the consumer's identity. The Todd Snyder decision turned in part on exactly this: requiring consumers to verify identity before processing an opt-out. You also may not require the consumer to create an account, and the process must not use dark patterns — the regulations require symmetry in choice, meaning opting out cannot take more steps or more clicks than opting in.
Practically: if 'Accept All' is one click, 'Reject All' must also be one click, at the same visual prominence, on the same screen.
Not sure where your site stands? Find out in a few minutes.
The 15-business-day chain
Once you receive a valid opt-out request, you must comply as soon as feasibly possible and in any event within 15 business days. You must also notify all third parties to whom you sold or shared the consumer's personal information after the request was submitted, and direct them to comply. This is the part most implementations omit entirely: stopping the pixel going forward without ever sending the downstream signal.
For the major ad platforms this maps to concrete mechanisms — Google's Restricted Data Processing flag, Meta's Limited Data Use flag, and the IAB's Global Privacy Platform (GPP) string with a US National or California section. If you use server-side conversion APIs, these flags must be set on the outbound event, not just on the client tag.
Opt-out of sensitive personal information is a separate right
The CPRA added a distinct right to limit the use and disclosure of sensitive personal information — precise geolocation, racial or ethnic origin, religious beliefs, contents of communications, health, sex life, and similar categories. If you collect these and use them beyond the purposes the statute permits, you owe a separate 'Limit the Use of My Sensitive Personal Information' link. GPC does not by itself carry a sensitive-information limitation, so this obligation must be met through your own interface.
Key enforcement actions
California AG — Sephora settlement
Cal. Att'y Gen., Aug. 2022, $1.2MAlleged failure to disclose the sale of personal information, failure to provide a Do Not Sell mechanism, and failure to honor GPC. Sephora also failed to cure within the (then-available) 30-day cure period.
Read the official source ↗California AG — DoorDash settlement
Cal. Att'y Gen., Feb. 2024, $375,000The AG alleged DoorDash sold customer personal information through a marketing cooperative without providing notice or an opt-out. Notable for establishing that participation in a data co-op is a 'sale'.
Read the official source ↗CPPA — Todd Snyder decision
Cal. Privacy Protection Agency, May 2025, $345,178Opt-out mechanism non-functional for 40 days; consumers required to verify identity for opt-out requests; privacy request form collected more information than necessary.
Read the official source ↗CPPA — Honda decision
Cal. Privacy Protection Agency, Mar. 2025, $632,500Asymmetric cookie controls (accepting was one click, rejecting took two), excessive information demanded for opt-out requests, and no simple mechanism for authorized agents.
Read the official source ↗FAQ
Does the CCPA apply to my business if I'm not in California?
Location does not matter; the thresholds do. The CCPA applies to for-profit businesses doing business in California that meet one of: over $25M annual gross revenue, buying/selling/sharing the personal information of 100,000+ California consumers or households, or deriving 50%+ of revenue from selling or sharing personal information.
Is there still a cure period before enforcement?
No. The CPRA eliminated the mandatory 30-day cure period as of January 1, 2023. Regulators may consider a good-faith cure, but they are not required to give you one.
What are the penalties?
Up to $2,663 per violation and $7,988 per intentional violation or violation involving a minor's data (amounts are inflation-adjusted). Because 'per violation' is often read per consumer, exposure scales with traffic.
Does a cookie banner satisfy the opt-out obligation?
Only if it actually blocks the sale/share when the user rejects, offers symmetric choices, and you separately honor opt-out preference signals. A banner that suppresses cookies but keeps firing advertising tags does not.
Official sources
- CCPA — official AG overview ↗— California Attorney General
- CCPA enforcement case examples ↗— California Attorney General
- Cal. Civ. Code § 1798.120 (right to opt out) ↗— California Legislative Information
- CCPA Regulations (full text) ↗— California Privacy Protection Agency
- Global Privacy Platform (GPP) technical specs ↗— IAB Tech Lab
Related reading
This guide is general information about California privacy law and the Global Privacy Control signal, not legal advice. Enforcement actions are summarized from official regulator publications; verify before relying on them. Consult qualified counsel for your specific situation.