CCPA Opt-Out Requirements in 2026: What Businesses Must Do Now

Why CCPA Opt-Out Compliance Matters More Than Ever

The right to opt out of the sale and sharing of personal information is one of the most actively enforced provisions of the California Consumer Privacy Act (CCPA/CPRA). In the first quarter of 2026 alone, California regulators issued over $4 million in fines against companies that failed to properly implement opt-out mechanisms — including Disney ($2.75M), PlayOn Sports ($1.1M), and Ford ($375K).

If your business collects personal information from California residents, getting opt-out compliance right is no longer optional — it is the single highest enforcement priority for state regulators.

The Core Opt-Out Requirements

Under the CCPA as amended by the CPRA and enforced by the California Privacy Protection Agency (CPPA), businesses that sell or share personal information must provide consumers with a clear, accessible way to opt out. Here is what that means in practice.

1. Provide a "Do Not Sell or Share" Link

Your website must include a clearly labeled link titled "Do Not Sell or Share My Personal Information" or the alternative combined link "Your Privacy Choices" (with the toggle icon). This link must be visible on your homepage and accessible from every page where personal information is collected.

The CPPA also permits a consolidated link called "Your California Privacy Choices" that combines both the opt-out of sale/sharing and the option to limit use of sensitive personal information.

2. Honor Global Privacy Control (GPC)

As of 2026, businesses must treat GPC signals as a valid consumer opt-out request. GPC is a browser-level signal (sent via the Sec-GPC: 1 HTTP header) that tells websites a user wants to opt out of data selling and sharing. California, Colorado, Connecticut, Montana, and Texas all require honoring GPC or universal opt-out signals.

Not sure if GPC applies to you? Use our GPC Compliance Checker to find out.

3. Display Opt-Out Confirmation

Starting January 1, 2026, businesses must visibly confirm that a consumer's opt-out request has been received and processed. The CPPA regulations require you to display a message such as "Opt-Out Preference Signal Honored" when a browser with GPC visits your site. This confirmation must be visible — hidden or buried messages do not satisfy the requirement.

4. Follow Symmetric Design Rules (No Dark Patterns)

The opt-out process must be as easy as opting in. This means:

The number of steps to opt out cannot exceed the number of steps to opt in
Opt-out buttons must have equal visual prominence to opt-in buttons
You cannot use confusing language, double negatives, or manipulative design to discourage opt-outs
Pre-checked consent boxes are not allowed

5. No Identity Verification for Opt-Outs

Unlike other CCPA rights (like data access or deletion), opt-out requests do not require identity verification. The Ford $375K fine was specifically for requiring email verification before processing opt-out requests. If a consumer clicks your opt-out link, you must process it without additional verification steps.

Common Mistakes That Lead to Fines

Based on recent enforcement actions, these are the most common opt-out compliance failures:

Broken opt-out mechanisms — the opt-out button exists but data sharing continues with some third parties (Disney's $2.75M fine)
Unauthorized tracking despite opt-out — cookies and advertising pixels still fire after a consumer opts out (PlayOn's $1.1M fine)
Adding verification steps — requiring email confirmation, account login, or multi-step processes (Ford's $375K fine)
Ignoring GPC signals — not detecting or processing the Sec-GPC header from browsers
Missing or hidden opt-out link — burying the link in the footer or making it difficult to find

Step-by-Step Compliance Checklist

Add the opt-out link — place "Do Not Sell or Share My Personal Information" prominently on your homepage and in your site footer
Implement GPC detection — check for the Sec-GPC: 1 header in incoming requests and suppress data sharing when present
Add visible confirmation — display "Opt-Out Preference Signal Honored" for GPC-enabled visitors and confirm all manual opt-outs
Audit third-party scripts — verify that all advertising pixels, analytics trackers, and data-sharing integrations actually stop when a user opts out
Remove verification barriers — ensure no email, phone, or identity verification is required for opt-out requests
Test the full flow — regularly test your opt-out mechanism end-to-end to confirm data sharing truly stops across all channels
Update your privacy policy — clearly describe how consumers can opt out and how you process GPC signals
Train your team — make sure customer service and marketing staff understand opt-out obligations

For a full state-by-state breakdown of your obligations, use our Privacy Law Calculator or view your California compliance checklist.

Which Other States Require Opt-Out Rights?

California is not alone. As of March 2026, all 20 states with comprehensive privacy laws provide some form of opt-out right. However, the specifics vary:

Universal opt-out mechanism required: California, Colorado, Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Texas, Oregon, Minnesota, Maryland
Opt-out of sale only: Virginia, Indiana, Iowa, Tennessee, Kentucky, Rhode Island, Oklahoma
GPC or similar signal recognized: California, Colorado, Connecticut, Montana, Texas

Use our state law comparison tool to see detailed differences between opt-out requirements across all states.

The Bottom Line

CCPA opt-out compliance is the single most common reason companies face privacy enforcement fines in 2026. The requirements are not complex, but they must be implemented thoroughly — a broken mechanism is treated the same as no mechanism at all. Start with the checklist above, test your implementation, and review it regularly.

This article provides general educational information and is not legal advice. Consult qualified legal counsel for guidance specific to your organization. Last updated: March 28, 2026.