Do Not Sell or Share My Personal Information
The footer opt-out California law requires if you sell personal information at all, or share it for cross-context behavioral advertising.
See it
What it is
CCPA as amended by the CPRA lets Californians stop the 'sale' and 'sharing' of their personal information, and 'sale' is far broader than money changing hands. Dropping a Meta pixel or a Google Ads tag that hands identifiers to a platform for cross-context behavioral advertising counts, and so does any other disclosure of personal information for money or other valuable consideration: selling a lead list, handing enrichment data to a partner, licensing your customer file. Ad tech is the loudest case, not the whole rule. If you do any of it, you owe users a clear link on your homepage and in your privacy policy, and it has to work without forcing them to create an account.
The modern implementation is the 'Your Privacy Choices' link plus the blue toggle icon, which several state laws now accept as the standard label. Underneath, most teams wire it to their consent management platform, which switches the ad tags off. Global Privacy Control matters here: California treats a browser-level GPC signal as a valid opt-out you must honor automatically, whether or not anyone ever clicks your link.
The gotcha is the link that opens a modal saying 'we do not sell your data' while the pixels keep firing. That mismatch is exactly what California's first CCPA enforcement action against Sephora turned on. Decide honestly whether your ad tags count as sharing, then make the toggle actually change what loads.
Ask AI for it
Implement a 'Your Privacy Choices' opt-out for a US site. Add a persistent footer link on every page (label it 'Your Privacy Choices' with the standard blue toggle icon, or 'Do Not Sell or Share My Personal Information') that opens a preferences panel: no account, no email, no dark patterns, identical effort to opt in and opt out. Before wiring any toggle, classify each vendor and disclosure: service provider or contractor under a compliant contract, third party receiving data for cross-context behavioral advertising, or another sale of personal information. Gate only the uses that constitute a sale or a share. Analytics running under a genuine service-provider contract should not be swept into the same switch, and a data disclosure that is a sale should not escape it just because no pixel is involved. Persist the choice in a first-party cookie, honor navigator.globalPrivacyControl and the Sec-GPC request header as an automatic opt-out before any tag loads, and when the visitor is signed in, apply the preference to their account so it survives a new device.