Under the CCPA, a covered business that sells or shares personal information must honor a user enabled Global Privacy Control signal as a valid request to stop the sale or sharing of that person's information. It must also offer at least two opt out methods and act no later than 15 business days after receipt.
What the Attorney General says
California's Attorney General states that businesses selling or sharing personal information must provide a clear "Do Not Sell or Share My Personal Information" link, cannot require an account to opt out, and must give at least two ways to opt out. For businesses collecting data online, a user enabled global privacy control is one acceptable method. The page describes it as a switch available in some browsers or as a browser extension, and says covered businesses must honor it.
"Sharing" refers specifically to cross context behavioral advertising.
After the opt out
Once someone opts out, the business cannot sell or share their information unless they later authorise it, and it must wait at least 12 months before asking them to opt back in. For opt outs, the page says to act as soon as feasibly possible and no later than 15 business days.
Engineering notes
The signal arrives as a browser setting that the page can detect. Treat the following as design suggestions, not legal text:
- Detect it early. Check the signal before loading advertising or sharing tags, not after.
- Apply it to the right scope. For logged out visitors apply it to the browser. For logged in users, consider applying it to the account too, and ask counsel how your regulator expects you to treat it.
- Do not break the site. The opt out should stop sale and sharing, not block basic functions.
- Log the decision. Record that a signal was received and what was suppressed.
- Test in a real browser. Turn the control on and watch network calls to third parties.
- Fix third party tags. A tag manager rule that ignores the signal defeats the control.
Children and consent
The same page says a business needs opt in consent before selling the information of a child it knows to be under 16, and parental consent for under 13.
Quick check
Is a cookie banner enough?
No. The page names a clear link and at least two methods, with a user enabled control honored as a valid request.
Does this apply to every company?
Only to covered businesses. Check the three thresholds.
Safeguard's free scan can help you review the third party packages in your web app, which is one place trackers hide. It does not test for privacy signals.
Sources
Last reviewed: 19 October 2026.
