Must I let consumers opt out of sale, sharing and targeted advertising?

Controller, Online retailer, Online service, SME

Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law that sell personal data, share it for cross-context behavioural advertising or profile consumers.

Yes, consumers may opt out of sale, targeted advertising and certain profiling, and several states require honouring a universal opt-out signal.

Provide a clear opt-out method such as 'Do Not Sell or Share My Personal Information', honour opt-out preference signals where required and stop the processing.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Map sales and targeted advertising
2. Publish the opt-out link
3. Honour Global Privacy Control where required
4. Stop selling or sharing after the request
5. Obtain opt-in for consumers under 16 (CCPA)

As soon as feasibly possible and no later than 15 business days under the CCPA regulations; otherwise 45 days.

• Cal. Civ. Code 1798.120
• Cal. Code Regs. tit. 11, 7026(f)
• Colo. Rev. Stat. 6-1-1306(1)(a)

sha256 4fbd55629c272414af22420e396c971252448fb927eb6e848384a577d1efcc84 · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · universal opt out: Opt-out preference signals must be honoured (Cal. Code Regs. tit. 11, 7025) · response deadline: 45 days · cure period: No statutory cure period for CPPA enforcement · max civil penalty: 2,500 dollars per violation, 7,500 dollars per intentional violation or violation involving minors under 16, adjusted for inflation (1798.155, 1798.199.90)
• VA, Virginia Consumer Data Protection Act · universal opt out: not in register · response deadline: 45 days · cure period: not in register · max civil penalty: 7,500 dollars per violation (59.1-584)
• CO, Colorado Privacy Act · universal opt out: Universal opt-out mechanism required from 1 July 2024 (6-1-1306(1)(a)(IV), 4 CCR 904-3) · response deadline: 45 days · cure period: 60-day cure period ended 1 January 2025 · max civil penalty: not in register
• CT, Connecticut Data Privacy Act · universal opt out: Opt-out preference signals must be honoured from 1 January 2025 (42-520(e)) · response deadline: 45 days · cure period: Mandatory cure period ended 31 December 2024 · max civil penalty: not in register
• TX, Texas Data Privacy and Security Act · universal opt out: Global opt-out signals must be honoured from 1 January 2025 (541.055(e)) · response deadline: 45 days · cure period: 30-day cure period (541.154) · max civil penalty: 7,500 dollars per violation (541.155)
• OR, Oregon Consumer Privacy Act · universal opt out: Universal opt-out mechanism required from 1 January 2026 (646A.574) · response deadline: 45 days · cure period: 30-day cure period until 1 January 2026 · max civil penalty: 7,500 dollars per violation (646A.589)

GDPR Art. 21crosswalk

• Which states require Global Privacy Control?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)