Do You Need a "Do Not Sell or Share" Link on Your Website?

Plenty of businesses assume the "Do Not Sell or Share My Personal Information" link is for data brokers. They do not sell customer lists, so they conclude it does not apply to them, and the footer stays as it is.

The problem is that California's definition of "sharing" was written with advertising pixels in mind. If your site runs the Meta pixel, TikTok, LinkedIn or Google Ads remarketing, you may be sharing personal information in the legal sense without ever handing over a spreadsheet.

Getting this wrong is not only a compliance question. The link has to actually do something, and on many sites it opens a form that changes nothing about what the tags send.

What counts as "selling" or "sharing" personal information?

Under California law, "selling" broadly means disclosing personal information to another business for money or other valuable consideration, and "sharing" means disclosing it for cross-context behavioral advertising. Advertising pixels commonly fall under sharing, even when no money changes hands for the data.

The CCPA, as amended by the CPRA, defines personal information widely. It includes online identifiers such as cookie IDs, IP addresses, device identifiers and browsing activity. That is exactly what advertising pixels collect.

Cross-context behavioral advertising means targeting ads to a person based on their activity across businesses, websites and services other than the one they are currently using. When your site loads the Meta pixel, Meta receives the visitor's identifiers and page activity and can use them to target that person with ads elsewhere, including ads from other advertisers. That is, in most cases, what the law has in mind by sharing.

The same analysis generally applies to TikTok, LinkedIn, Pinterest, Reddit, Snapchat, programmatic ad networks and Google's advertising features such as remarketing. First-party analytics used only by you is typically viewed differently, although the details depend on how the tool is configured and what the vendor is permitted to do with the data. Your counsel should decide how each tag is classified.

Does the CCPA apply to my business?

It applies to for-profit businesses that do business in California, collect consumers' personal information, and meet at least one threshold: annual gross revenue above a set amount, buying, selling or sharing the personal information of a large number of California consumers or households, or deriving most of their annual revenue from selling or sharing personal information.

The revenue threshold is adjusted periodically for inflation, and the consumer-count threshold is set in the statute, so check the current figures rather than relying on a number you read a few years ago. The California Privacy Protection Agency publishes the adjusted amounts.

A few points catch businesses out:

• You do not need to be based in California. Doing business there and collecting California residents' information can be enough.
• The consumer-count threshold can be reached through website traffic alone, since cookie identifiers and IP addresses count as personal information.
• The revenue threshold is based on total annual revenue, not California revenue.

If you are close to any of these lines, this is a conversation to have with privacy counsel, because the answer shapes everything else in this article.

What does the "Do Not Sell or Share" link have to say?

Businesses that sell or share personal information must provide a clear link titled "Do Not Sell or Share My Personal Information," or use the alternative "Your Privacy Choices" link with its accompanying opt-out icon.

The wording of the primary link is set by regulation, so it is not a place for creative copy. "Privacy Settings" or "Manage Cookies" on its own is not the same thing.

The alternative, "Your Privacy Choices," comes with an official toggle-style icon. It can be used as a single combined link that lets consumers exercise their opt-out of sale and sharing, and, where applicable, limit the use of sensitive personal information, in one place. Many businesses prefer it because it reads less alarmingly than a link that says "Do Not Sell," and because one link can serve several purposes.

Whichever you use, the regulations set out specific requirements for how it is displayed and what it leads to. Confirm the exact wording, icon usage and destination with counsel.

Where should the "Do Not Sell or Share" link be placed?

Generally in the website footer, on every page, where visitors expect to find privacy links. It also needs to be available through the other channels where you collect personal information.

The footer is the standard location because it is present on every page of most sites and is where visitors look for privacy links. A link buried in the privacy policy alone is unlikely to be sufficient, since the purpose is for consumers to find it easily.

Also check:

• Mobile layouts. Footers are often collapsed or trimmed on mobile. Make sure the link survives.
• Every template. Checkout flows, landing pages and microsites often use different templates and can lose the footer entirely.
• Apps and other channels. If you collect personal information in an app, the opt-out needs to be available there too.

What should happen when someone clicks "Do Not Sell or Share"?

The visitor should be able to opt out easily, without creating an account, and the opt-out should take effect in your tracking, not only in a database. In practice, that means advertising tags that share data stop firing or switch to a restricted mode for that visitor.

This is the part most implementations get wrong. The link opens a form or a preference panel, the visitor submits it, a record is created, and the Meta pixel keeps firing on the next page view. On paper the request was processed. In the Network tab nothing changed.

A working implementation usually does the following:

Records the choice in the browser so it applies immediately, typically as a consent state that your consent platform or tag manager reads.

Stops or restricts sharing tags. Meta, TikTok, LinkedIn and similar pixels either stop firing or switch to a limited processing mode, such as Meta's Limited Data Use. Google tags can be set to restricted data processing, which limits how Google uses the data.

Applies to known users too. If the visitor is logged in or otherwise identifiable, the opt-out should be linked to their profile so it follows them across devices and into server-side flows, such as offline conversion uploads or customer list syncs.

Does not add friction. The regulations discourage making opt-outs harder than opt-ins. Asking for unnecessary information or routing the visitor through several steps undermines the request.

After the opt-out, the business is generally expected to wait a period before asking the consumer to opt back in. Check the specifics with counsel.

How does the link relate to my cookie banner and Global Privacy Control?

They are three ways into the same outcome. The link is the explicit opt-out, the banner may offer the same choice, and Global Privacy Control is a browser signal that California regulations require businesses to treat as an opt-out request too.

A US cookie banner configured for opt-out typically shows a notice and lets visitors turn off advertising cookies. That can satisfy part of the requirement if it clearly offers the opt-out of sale and sharing, but many banners only mention "cookies" and never reach tags such as server-side conversion feeds.

Global Privacy Control, sent as the Sec-GPC: 1 header and exposed as navigator.globalPrivacyControl, must generally be honored without the visitor clicking anything. California's first public enforcement settlement under the CCPA, with Sephora in 2022 for $1.2 million, centered on failing to disclose the sale of personal information and failing to honor GPC.

All three routes should land in the same state. A visitor who opts out through the link, through the banner or through GPC should see the same result in your tracking, and the preference center should reflect it whichever route they took.

Do other states require a "Do Not Sell or Share" link?

Several other states have comprehensive privacy laws with an opt-out right for targeted advertising, including Colorado, Connecticut, Texas, Oregon, Montana and Minnesota. Their wording and mechanics differ from California's, but most require a clear and conspicuous way to opt out.

The common pattern across these laws is opt-out for targeted advertising and the sale of personal data, and opt-in for processing sensitive data. Colorado, like California, requires honoring universal opt-out mechanisms, and several other states have adopted similar requirements.

Most businesses operating nationally end up with a single approach: one link, typically "Your Privacy Choices," that handles opt-outs for every state where they apply, backed by consent platform rules that detect the visitor's region and GPC signal. That is simpler to maintain than a patchwork, though whether it satisfies each state's specific requirements is a question for counsel.

The short version

If your site runs advertising pixels and your business meets the CCPA thresholds, you likely need the link. Having it is only half the job. Click it, then watch the Network tab, and confirm the pixels actually stop. An audit or scan that tests the opt-out path, not just the presence of the link, tells you whether it works.

FAQ

Do I need a "Do Not Sell or Share" link if I do not sell data?

Possibly. Under California law, "sharing" includes disclosing personal information for cross-context behavioral advertising, which advertising pixels such as Meta, TikTok and Google Ads remarketing commonly do. If your business meets the CCPA thresholds and runs those tags, you may be sharing even though you never sell a customer list. Confirm how your tags are classified with privacy counsel.

What is the "Your Privacy Choices" link?

It is an alternative to the "Do Not Sell or Share My Personal Information" link permitted under California's regulations, displayed with an official toggle-style icon. A single "Your Privacy Choices" link can let consumers opt out of the sale and sharing of their information and, where relevant, limit the use of sensitive personal information. The wording and icon are specified, so follow them exactly.

Where does the "Do Not Sell or Share" link need to go?

Generally in the website footer on every page, where visitors expect to find privacy links. It should survive mobile layouts and appear on every template, including checkout and landing pages that use different footers. If you collect personal information in an app or other channel, the opt-out needs to be available there as well.

Does clicking the link need to stop my ad pixels?

In most cases, yes. The purpose of the opt-out is to stop the sale and sharing of the visitor's personal information, and advertising pixels are usually how sharing happens. After a click, sharing tags should stop firing or switch to a restricted mode, such as Google's restricted data processing. A link that only records the request while pixels keep firing does not achieve that.

Is the "Do Not Sell or Share" link the same as honoring Global Privacy Control?

No, they are separate requirements that should produce the same outcome. The link is an opt-out the visitor clicks. Global Privacy Control is a browser signal that California regulations require businesses to treat as an opt-out without any click. A site can have the link and still ignore GPC, which was central to California's Sephora settlement in 2022.