CCPA Opt-Out:
A Guide for Businesses

The California Consumer Privacy Act (CCPA) grants California residents significant control over their personal information, including the right to opt out of the “sale” or “sharing” of their data. For businesses operating in California, CCPA compliance is essential. This guide outlines the key requirements for handling opt-out requests and ensuring your business meets its obligations.

The CCPA’s definitions of “sale” and “sharing” are broad and encompass more than just traditional monetary exchanges.

• Sale:
  Includes the exchange of personal information for any valuable consideration, not just money. This can include sharing data with third-party advertisers, data brokers, or other businesses.
• Sharing:
  Refers to the disclosure, transfer, or other communication of a consumer’s personal information to a third party for cross-context behavioral advertising, regardless of whether money is exchanged.

The CCPA applies to businesses that:

• Do business in California.
• Meet one or more of the following thresholds:
  • Annual gross revenues exceeding $25 million.
  • Buy, receive, or sell the personal information of 50,000 or more consumers, households, or devices.
  • Derive 50% or more of their revenue from selling or sharing consumers’ personal information.

You must provide a clear and conspicuous link on your website, typically in the footer, labeled “Do Not Sell or Share My Personal Information.” This link must be easily visible and accessible to consumers.

Clicking the link should take consumers to a dedicated webpage where they can submit their opt-out request.

The opt-out webpage should clearly explain the consumer’s right to opt out and provide instructions on how to submit a request.

The opt-out process should be as simple and straightforward as possible. Avoid unnecessary steps or requests for information that are not essential for verifying the consumer’s identity or processing the request.

You may need to verify the consumer’s identity before processing their request. However, the verification process should not be overly burdensome. Request only the minimum necessary information.

You must allow consumers to designate an authorized agent to submit an opt-out request on their behalf.

Once you have processed the request, you must confirm to the consumer that their personal information will no longer be sold or shared.

You must respect the consumer’s opt-out choice for at least 12 months before asking them to opt back in.

You must provide consumers with a clear and conspicuous notice of their right to opt-out, typically within your privacy policy.

Train your staff on handling opt-out requests and maintaining proper documentation of all requests and responses.

You cannot discriminate against consumers who exercise their opt-out rights. This means you cannot deny them services, charge them different prices, or provide them with a different level of service.

In addition to the requirements above, businesses should be aware of Global Privacy Control (GPC). GPC is a browser setting or extension that allows users to automatically communicate their privacy preferences to websites. It signals a user’s intent to opt out of the sale or sharing of their personal information.

• Treat GPC Signals as Valid Requests:
  Under the CCPA, businesses are required to treat user-enabled GPC signals as valid requests to opt out of the sale or sharing of personal information.
• Integrate GPC Detection:
  Implement systems that can detect and respond to GPC signals. This demonstrates a commitment to consumer privacy and simplifies the opt-out process for users.
• Stay Informed:
  Keep up-to-date on the latest developments regarding GPC and its implications for CCPA compliance.

• Regularly Review Your Privacy Policy:
  Ensure your privacy policy is up-to-date and accurately reflects your data collection and sharing practices.
• Map Your Data Flows:
  Understand where your data comes from, where it goes, and how it is used.
• Implement a Data Subject Request (DSR) Process:
  Establish a clear process for handling all types of consumer requests, including opt-out requests and GPC signals.
• Stay Informed:
  Keep up-to-date on changes to the CCPA and other privacy regulations.
• Consult with Legal Counsel:
  If you have any questions or concerns about CCPA compliance, consult with an attorney specializing in privacy law.

Failure to comply with the CCPA can result in significant penalties, including fines and legal action.

By implementing the steps outlined in this guide, businesses can ensure they are meeting their obligations under the CCPA and protecting the privacy rights of California consumers. Proactive compliance avoids legal risks and builds trust with your customers.