DataTerminology.comNEW
A consumer directive, notably under CCPA/CPRA, to opt out of the sale of their personal information.
DESCRIPTION
“Do Not Sell” grants consumers the right to opt out of the sale of personal information, requiring businesses to provide clear mechanisms and honor signals like Global Privacy Control. Compliance includes updating privacy notices, providing a conspicuous link, and aligning data flows and vendor contracts. Engineering teams implement preference storage, enforcement in data pipelines, and response to browser signals. CPRA expands obligations, adding “Do Not Share” for cross-context behavioral advertising.
ALTERNATIVE DEFINITIONS
California Attorney General
The CCPA gives consumers the right to opt out of the sale of their personal information.
Authoritative statement of the opt-out right under CCPA.
California Privacy Protection Agency
Businesses must provide a clear and conspicuous ‘Do Not Sell or Share My Personal Information’ link and honor opt-out preference signals.
Adds regulatory requirements for links and signals under CPRA.
Global Privacy Control
GPC is a specification for a browser signal that indicates a user’s opt-out of sale or sharing of personal data.
Defines the mechanism to communicate opt-out across the web.
RELATED TERMS
California Consumer Privacy Act (CCPA) Opt-Out Preference Signal Global Privacy Control Personal Data Consent Management Cookie Banner Data Sale Privacy Notice Data Subject Rights
COMPETING TERMS
Opt-In Consent Do Not Share
KNOWLEDGE AREAS
Data Privacy & Compliance AI Governance
TARGET AUDIENCE
Data Privacy Officer Data Governance Manager Chief Data Officer AI Product Manager
EXTERNAL SOURCES
- Wikipedia - California Consumer Privacy Act
- California Attorney General - Official CCPA overview and guidance
- CPPA - CPRA regulations on opt-out and signals
- GPC - Signal specification for opt-out
- IAB Tech Lab - CCPA compliance framework for ads
TOP QUESTIONS
Why is Do Not Sell important for organizations?
It’s a legal requirement under CCPA/CPRA, protecting consumer rights and reducing privacy risks through transparent data handling.
Category: Relevancy
How do businesses implement Do Not Sell?
Provide a prominent opt-out link, honor GPC signals, update privacy notices, and enforce preferences across data sharing workflows.
Category: Requirements
What are common mistakes with Do Not Sell?
Nonfunctional links, ignoring GPC, failing to propagate opt-outs to vendors, and unclear definitions of “sale” and “share.”
Category: Mistakes
What is a competing concept to Do Not Sell?
Opt-in consent requires affirmative permission before processing, often used for sensitive data cases.
Category: Alternatives
How does Do Not Sell relate to data subject rights?
It complements rights like access, deletion, and correction by controlling third-party transfers.
Category: Overview
What is the biggest misunderstanding about Do Not Sell?
That it only covers monetary transactions; “sale” can include exchanging data for value such as services.
Category: Misunderstanding
How should teams manage Do Not Sell preferences technically?
Store opt-out flags, enforce at API and ETL layers, and conduct audits to verify compliance.
Category: Management
What is a hot topic around Do Not Sell?
Global Privacy Control adoption and cross-site enforcement mechanisms.
Category: Topic
Where to learn more about Do Not Sell?
Review California AG and CPPA resources, and the GPC specification for technical implementation details.
Category: Overview