Do Not Sell My Personal Information: What It Means and How to Use It

“Do Not Sell or Share My Personal Information” is a link that California privacy law requires covered businesses to display if they sell personal information or share it for cross-context behavioral advertising. Clicking it lets California residents opt out, and the business must then stop selling or sharing their data. It limits what a company does with your information; it doesn’t delete it.

That distinction matters if your goal is privacy or reputation. Opting out cuts off one route by which your data spreads to data brokers and ad networks. Getting data removed takes a different request, which this guide also covers.

Where the “do not sell” link comes from

The link comes from the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, usually called the CCPA). The law gives California residents the right to tell a covered business not to sell their personal information, and since the CPRA amendments, not to “share” it either.

Both words have specific meanings under the law:

• Sell is broad. It covers handing over personal information to another company for money or “other valuable consideration,” not just a straightforward cash sale.
• Share means giving personal information to a third party for cross-context behavioral advertising: targeting you with ads based on what you do across different sites and apps.

So a site that never takes a check for your data can still be “selling” or “sharing” it under the CCPA, for example by letting advertising partners collect data about you through its pages.

Who can use it, and which businesses must offer it

The right belongs to California residents. The duty falls on for-profit businesses that do business in California and meet at least one of the law’s thresholds, which are based on annual revenue, the volume of consumers’ personal information they buy, sell or share, or how much of their revenue comes from selling or sharing it. Many smaller businesses aren’t covered.

If you don’t live in California, you may still have a similar right. Several other states with comprehensive privacy laws let residents opt out of the sale of their personal data and of targeted advertising, though the wording, thresholds and exceptions differ. Some companies also honor opt-outs from everyone, because it’s simpler than checking where each person lives.

What you’ll see on websites

A covered business that sells or shares personal information should give you a clear way to opt out, usually a link in the website footer. You may see it labeled in one of these ways:

• “Do Not Sell or Share My Personal Information”
• “Your Privacy Choices” or “Your California Privacy Choices,” often next to a small toggle icon, which the regulations allow as an alternative that combines opt-outs in one place
• “Limit the Use of My Sensitive Personal Information,” a separate right covering data such as precise location, government ID numbers and health information

Businesses must also honor opt-outs sent through an opt-out preference signal, which brings us to the most efficient option.

How to opt out, step by step

1. Turn on Global Privacy Control. Global Privacy Control (GPC) is a browser signal that tells every site you visit that you’re opting out of sale and sharing. California’s regulations require covered businesses to treat it as a valid opt-out. Some privacy-focused browsers include a GPC setting; for others, you can add it through a privacy extension that supports it.
2. Use the link on sites you care about most. GPC is tied to the browser, so a business may not be able to connect it to your account or to data you gave it offline. For companies that hold a lot about you, such as retailers, apps and streaming services, click the opt-out link as well, while logged in.
3. Complete any form. Businesses may ask for enough information to apply the opt-out, such as your email address, but they can’t require you to create an account just to opt out, and an opt-out request doesn’t need the kind of identity verification a deletion request does.
4. Check your phone apps. Apps have their own privacy settings. Look in each app’s settings or privacy section for a “do not sell or share” option.
5. Keep a record. Save a screenshot or confirmation email for important companies, in case you need to follow up.

Under the CCPA regulations, a business must act on an opt-out as soon as feasible and within an outer limit of 15 business days. It also has to wait at least 12 months before asking you to opt back in.

Opt-out vs. deletion vs. DROP

People often click “do not sell” expecting their profile on a people-search site to vanish. That isn’t what it does. Here’s how the main California rights compare:

Right	What it does	Best for
Opt out of sale or sharing	Stops the business from selling your data or using it for cross-context ad targeting	Retailers, apps, publishers and ad-supported sites you use
Deletion request	Asks the business to delete personal information it collected from you, subject to exceptions	Accounts and companies you no longer want holding your data
Access request (right to know)	Tells you what the business holds, where it came from and who received it	Tracing how your data spread before deleting it
The Delete Act’s DROP platform	Sends one deletion request to every registered data broker	People-search sites and other data brokers

For the brokers, the California Delete Act guide explains DROP. For tracing where your data came from, see our guide to making a data access request.

A worked example

This is an illustrative scenario, not a real client. A small-business owner in San Diego starts getting targeted mail and calls after signing up for several online services, and later finds his home phone number on a people-search site.

He switches on Global Privacy Control in his browser and clicks the opt-out link while logged in to the retail and streaming accounts he uses most. That slows the flow of his data to advertising partners going forward. It does nothing about the existing people-search listing, so he submits a deletion request through DROP, opts out of the site directly, and requests removal of the Google result using Results about you. Three different tools for three different problems.

What “do not sell” won’t do

• It won’t delete data. The business keeps what it has unless you also ask it to delete.
• It won’t undo past sales. Data already sold stays with the buyer. You’d need to contact that company separately.
• It won’t reach publicly available information. The CCPA’s definition of personal information excludes certain publicly available information, such as data lawfully made available from government records. That limits what an opt-out can do on sites built from public records.
• It won’t remove search results. Google results change only when the page changes or Google grants a removal request. Our guide on removing personal information from Google covers that side.

If you run a business

If your business might be covered, check whether your site’s analytics, advertising pixels or data partnerships count as selling or sharing. Many companies are surprised to learn that ordinary ad tracking can qualify. Covered businesses need a working opt-out link or alternative, must honor Global Privacy Control, and must describe consumers’ rights in their privacy policy. Talk to a privacy lawyer about your specific setup; this guide is general information, not legal advice.

Common mistakes

• Relying on GPC alone for accounts. The signal applies to that browser. Opt out while logged in on the accounts that matter.
• Treating opt-out as a cleanup tool. It’s prevention. Existing listings need deletion requests and search removal.
• Handing over more ID than needed. Opt-outs shouldn’t require identity documents. Be wary of any site that demands them for a simple opt-out.
• Forgetting other devices. Each browser and phone needs GPC switched on separately.

If your personal details are already spread across many sites, our content removal service handles the removal side and tells you plainly what can and can’t come down.

Frequently asked questions

Does clicking do not sell my personal information delete my data?

No. It stops a covered business from selling your personal information or sharing it for cross-context behavioral advertising. To have the data removed, make a separate deletion request.

Can I use the do not sell link if I don't live in California?

The CCPA right belongs to California residents. Some other states give their residents a similar right to opt out of sales and targeted advertising, and some businesses honor opt-outs from everyone.

What is Global Privacy Control?

It is a browser signal that tells websites you are opting out of the sale and sharing of your personal information. California’s regulations require covered businesses to treat it as a valid opt-out request. Some browsers have a built-in setting, and privacy extensions can add it to others.

Can a business charge me or treat me differently for opting out?

Under the CCPA, a business can’t retaliate against you for exercising your rights, for example by denying service or charging a different price. Loyalty and discount programs are allowed under specific rules about financial incentives.