Under the CCPA, which opt-out links and methods must a news website that shares readers' data for targeted advertising provide?

## The statutory links Under the CCPA as amended by the CPRA, Civil Code `1798.135(a)` applies to a business that sells or shares personal information, or uses sensitive personal information beyond the purposes in `1798.121(a)`. It must, in a form reasonably accessible to consumers: 1. Post a clear and conspicuous link on its homepages titled **'Do Not Sell or Share My Personal Information'**, leading to a page where a consumer, or someone they authorise, can opt out; 2. Post a link titled **'Limit the Use of My Sensitive Personal Information'**, if it uses sensitive personal information beyond the permitted purposes; or 3. At its discretion, use **a single clearly labelled link** that does both. `1798.135(d)` lets a business put the links on a separate homepage dedicated to California consumers, provided it takes reasonable steps to direct Californians there. ## The Alternative Opt-out Link The CCPA regulations (11 CCR 7015) specify the single link. It must: - be titled **'Your Privacy Choices'** or **'Your California Privacy Choices'**; - carry the prescribed **opt-out icon**, roughly the size of other header or footer icons; - sit in the **header or footer** of the homepage and be conspicuous; - lead to a page describing both the right to opt out of sale or sharing and the right to limit, with a form to exercise both. ## Methods, not just links 11 CCR 7026(a) requires **two or more designated methods**, at least one reflecting how the business primarily interacts with consumers. For a business collecting personal information online, the minimum is: - processing **opt-out preference signals**, and - at least one of: an interactive form behind the 'Do Not Sell or Share' link, the Alternative Opt-out Link, or the privacy policy, if the business processes signals in a frictionless manner. A **cookie banner or cookie controls** is not, by itself, an acceptable method, because cookies concern the collection of personal information, not its sale or sharing (7026(a)(4)). ## What the method may not demand | Rule | Source | |---|---| | No account creation, no information beyond what is necessary | `1798.135(c)(1)`, 7026(c) | | No verifiable consumer request; ask only for what is needed to apply the opt-out | 7026(d) | | Easy to execute, minimal steps, compliant with 11 CCR 7004 | 7026(b) | | Personal information from the opt-out request used only to comply with it | `1798.135(c)(6)` | | An authorised agent needs the consumer's signed permission, except for signals | 7026(j) | ## After the reader opts out 1. **Stop** selling and sharing as soon as feasibly possible and **no later than 15 business days** after receiving the request (7026(f)(1)). 2. **Notify** third parties to whom the personal information was sold or shared between the request and compliance, directing them to comply and forward the request (7026(f)(2)). 3. **Wait at least 12 months** before asking the consumer to consent to sale or sharing again (`1798.135(c)(4)`, 7026(k)). 4. If the reader later wants to opt back in, use a **two-step** opt-in: a clear request, then a separate confirmation (11 CCR 7028(a)). The business may show a confirmation such as 'Consumer Opted Out of Sale/Sharing' or a toggle (7026(g)), and may offer granular choices only if a single option to opt out of everything is also offered (7026(h)). ## The news-site answer A news site that shares readers' identifiers with ad-tech partners posts the 'Do Not Sell or Share' link or the 'Your Privacy Choices' link in its footer, processes opt-out preference signals, describes the right and the links in its privacy policy (`1798.135(c)(2)`), and wires the opt-out into the tag layer so that affected tags stop firing for that reader within the 15-business-day limit, and sooner where feasible.