← CCPA/CPRA · Opt-outs and sensitive data

1798.135 — "Do Not Sell or Share" and "Limit the Use" links

high opt-out-of-saleprivacy-notice

Requirement

A business that sells or shares personal information provides a clear and conspicuous "Do Not Sell or Share My Personal Information" link, and one that uses sensitive personal information beyond permitted purposes provides a "Limit the Use of My Sensitive Personal Information" link — or a single Alternative Opt-out Link — on its homepage and in its privacy policy.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

do not sell or share my personal informationdo not sell my personal informationlimit the use of my sensitive personal informationyour privacy choicesalternative opt-out linkopt-out linkdo not sell link

Required element 2 — any one of

homepagehome pagefooterwebsitelinkclear and conspicuousprivacy policy

Supporting terms — specificity signals

1798.135regs 7013regs 7014icon

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.5(1)(a)	Lawfulness, fairness and transparency	privacy-notice
GDPR	Art.12	Transparent communication and handling of rights requests	privacy-notice
GDPR	Art.13	Information when data is collected from the data subject	privacy-notice
GDPR	Art.14	Information when data is not obtained from the data subject	privacy-notice
SOC 2	CC2.3	External communication	privacy-notice
SOC 2	P1.1	Notice and communication of privacy commitments	privacy-notice
GLBA	Reg P 1016.4-1016.6	Initial and annual privacy notices	privacy-notice
COPPA	312.4(d)	Online notice of children's information practices	privacy-notice