← CCPA/CPRA · Opt-outs and sensitive data

1798.120 — Right to opt out of sale and sharing

critical opt-out-of-saleconsent

Requirement

Consumers may direct a business that sells personal information or shares it for cross-context behavioural advertising to stop, and the business must honour the opt-out and not ask again for at least 12 months. A business that does not sell or share must say so.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

opt outopt-outdo not selldo not sharewe do not sellwe don't selldoes not sellwe never sellwe do not sharenot sold or sharednever sold

Required element 2 — any one of

salesellsellingsoldsharesharingcross-context behavioral advertisingcross-context behavioural advertisingtargeted advertisingwe do not sellwe don't selldoes not sellwe never sellwe do not sharenot sold or sharednever sold

Supporting terms — specificity signals

1798.12012 monthsregs 7026we do not sellhonor…honour…

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

cannot opt out opt-outs are not honored opt-outs are not honoured

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GLBA	Reg P 1016.7-1016.10	Opt-out of sharing with nonaffiliated third parties	consent opt-out-of-sale
GDPR	Art.6	Lawful basis for processing	consent
GDPR	Art.7	Conditions for consent	consent
GDPR	Art.21	Right to object, including to direct marketing	consent
COPPA	312.5	Verifiable parental consent before collection	consent
NDPA 2023	s.25	Lawful basis for processing	consent
NDPA 2023	s.26	Conditions for valid consent	consent
GDPR	Art.8	Conditions for a child's consent to online services	consent