California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7013 - Notice of Right to Opt-Out of Sale/Sharing and the "DO Not Sell or Share MY Personal Information" Link

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose of the Notice of Right to Opt-out
				  of Sale/Sharing is to inform consumers of their right to direct a business that
				  sells or shares their personal information to stop selling or sharing their personal
				  information and to provide them with the opportunity to exercise that right. The
				  purpose of the "Do Not Sell or Share My Personal Information" link is to immediately
				  effectuate the consumer's right to opt-out of sale/sharing, or in the alternative,
				  direct the consumer to the Notice of Right to Opt-out of Sale/Sharing. Accordingly,
				  clicking the business's "Do Not Sell or Share My Personal Information" link will
				  either have the immediate effect of opting the consumer out of the sale or sharing
				  of personal information or lead the consumer to a webpage where the consumer can
				  learn about and make that choice.
(b)
				  The Notice of Right to Opt-out of Sale/Sharing shall comply with section
				  7003, subsections (a) and
				  (b).
(c) The "Do Not Sell or Share My
				  Personal Information" link shall be a conspicuous link that complies with section
				  7003, subsections (c) and (d) and is
				  located at either the header or footer of the business's internet
				  homepage(s).
(d) In lieu of posting the
				  "Do Not Sell or Share My Personal Information" link, a business may provide the
				  Alternative Opt-out Link in accordance with section
				  7015 or process opt-out preference
				  signals in a frictionless manner in accordance with section
				  7025, subsections (f) and (g). The
				  business must still post a Notice of Right to Opt-out of Sale/Sharing in accordance
				  with these regulations.
(e) A business
				  that sells or shares the personal information of consumers shall provide the Notice
				  of Right to Opt-out of Sale/Sharing to consumers as follows:
(1) A business shall post the Notice of Right to
				  Opt-out of Sale/Sharing on the internet webpage to which the consumer is directed
				  after clicking on the "Do Not Sell or Share My Personal Information" link. The
				  notice shall include the information specified in subsection (f) or be a link that
				  takes the consumer directly to the specific section of the business's privacy policy
				  that contains the same information. If clicking on the "Do Not Sell or Share My
				  Personal Information" link immediately effectuates the consumer's right to opt-out
				  of sale/sharing or if the business processes opt-out preference signals in a
				  frictionless manner and chooses not to post a link, the business shall provide the
				  notice within its privacy policy.
(2) A
				  business that does not operate a website shall establish, document, and comply with
				  another method by which it informs consumers of their right to opt-out of
				  sale/sharing. That method shall comply with the requirements set forth in section
				  7003.
(3) A business shall also provide the notice to
				  opt-out of sale/sharing in the same manner in which it collects the personal
				  information that it sells or shares. Illustrative examples follow.
(A) A business that sells or shares personal
				  information that it collects in the course of interacting with consumers offline,
				  such as in a brick-and-mortar store, shall provide notice through an offline method,
e.g.
, on the paper forms that collect the personal information or
				  by posting signage in the area where the personal information is collected directing
				  consumers to where the notice can be found online.
(B) A business that sells personal information
				  that it collects over the phone shall provide notice orally during the call when the
				  information is collected.