Question 1

What is a 'Do Not Sell My Personal Information' link?

Accepted Answer

A "Do Not Sell My Personal Information" link is a mandatory website element required by the California Consumer Privacy Act (CCPA/CPRA) and other state privacy laws. It provides consumers with a clear, conspicuous way to opt out of the sale or sharing of their personal information. The link must be placed in a prominent location, typically the website footer, and must lead to a page where consumers can submit their opt-out request.

Question 2

Which states require an opt-out link on websites?

Accepted Answer

As of 2026, over 20 US states have enacted comprehensive privacy laws requiring some form of opt-out mechanism. California requires a specific "Do Not Sell or Share My Personal Information" link. Colorado, Connecticut, Texas, Montana, Oregon, Delaware, Nebraska, New Jersey, Maryland, and Minnesota require honoring universal opt-out mechanisms like Global Privacy Control (GPC). Virginia, Utah, and other states require opt-out mechanisms but do not mandate GPC recognition.

Question 3

How do I implement Global Privacy Control (GPC)?

Accepted Answer

Global Privacy Control (GPC) is a browser-level signal that communicates a user's opt-out preference. To implement GPC: (1) detect the Sec-GPC HTTP header on the server side, (2) check navigator.globalPrivacyControl in client-side JavaScript, (3) when either signal is detected, treat it as a valid opt-out request and suppress data sale, sharing, and targeted advertising. Many consent management platforms (CMPs) support GPC detection natively.

Question 4

What happens when someone clicks the 'Do Not Sell' link?

Accepted Answer

When a consumer clicks the "Do Not Sell" link, they should be taken to a dedicated page where they can submit an opt-out request. The page typically includes a form to collect identifying information (name, email) and the specific types of data processing they want to opt out of. Once submitted, your organization must process the request within the timeframe required by applicable law (typically 15-45 days) and stop selling or sharing that consumer's personal information.

Question 5

Do I need separate opt-out mechanisms for each state?

Accepted Answer

No, you do not need separate opt-out mechanisms for each state. Best practice is to implement the most comprehensive requirements — typically California's CCPA/CPRA standards — which will satisfy the requirements of other states as well. Use the "Do Not Sell or Share My Personal Information" link text, implement GPC detection, and provide a comprehensive opt-out form covering sale, sharing, and targeted advertising. This single implementation covers all state requirements.

Opt-Out Link & Mechanism Generator

Where does your business operate?

Website Information

Frequently Asked Questions