US-CaliforniaCan I opt out of the sale of my personal information?
Yes, California residents have the right to opt out of the sale of their personal information under the CCPA and CPRA.
What the Law Says
California law gives you a clear, enforceable right to stop businesses from selling your personal information.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants California residents the right to opt out of the 'sale' or 'sharing' of their personal information. A 'sale' includes exchanging personal data for monetary or other valuable consideration — even if no money changes hands.
Businesses must provide a clear and conspicuous 'Do Not Sell or Share My Personal Information' link on their website homepage. They must honor opt-out requests within 45 days (with one 45-day extension allowed if reasonably necessary). Once you opt out, the business cannot sell or share your information unless you explicitly re-consent later.
This right applies to all consumers aged 13 or older. For minors aged 13–15, businesses must obtain affirmative consent before selling or sharing their data. For children under 13, parental consent is required.
Statutory TextA consumer shall have the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.
— Civil Code § 1798.120(a) — Right to opt out of sale
Statutory TextA business shall comply with a request to opt-out within 15 business days of receiving the request.
— Cal. Code Regs. tit. 11, § 7028(c) — Response timeframe
Statutory TextA business shall not collect additional information from a consumer as part of the verification process unless necessary to verify the consumer’s identity.
— Civil Code § 1798.100(d) — Verification limits
What to Do
Look for the 'Do Not Sell or Share My Personal Information' link on the business’s website homepage (required by law).
Click the link and follow the instructions — usually involves submitting your email or account info.
If no link exists, submit an opt-out request via email, phone, or web form (businesses must offer at least two methods).
Keep a record of your request — businesses must confirm receipt within 10 business days and comply within 45 days.
You may use authorized agents (including browser plugins like Global Privacy Control) to submit opt-out signals on your behalf.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.