CCPA and CPRA: designing opt-out that actually works
California’s privacy law is opt-out first for sale and sharing. Your banner, GPC handling, and “Do Not Sell” link have to agree.
The California Consumer Privacy Act, as amended by the CPRA, gives consumers rights to know, delete, correct, and opt out of sale or sharing of personal information, including cross-context behavioral advertising.
Unlike GDPR, California does not always require prior opt-in for analytics. It does require a clear opt-out path, honoring Global Privacy Control (GPC) signals, and careful treatment of sensitive personal information.
Sale, sharing, and service providers
If adtech partners receive identifiers for advertising, you may be “selling” or “sharing” even if no money changes hands. Service-provider contracts and purpose limitation become as important as the banner UI.
A consent manager should translate “Do Not Sell or Share” into vendor-level suppression, not just a footer link that emails legal.
Educational overview only — not legal advice. Confirm requirements with counsel for your products and markets.
