Consumers can opt out of sale or sharing of personal information

CCPA § 1798.120 and § 1798.135 require businesses that sell or share personal information to provide a conspicuous opt-out mechanism. Under CPRA, "sharing" now includes disclosing identifiers to advertising platforms for cross-context behavioral advertising — which means Facebook Pixel, Google Ads remarketing, and TikTok Pixel qualify even when no money changes hands. A footer link that only describes the right without providing an actual opt-out button is non-compliant. An opt-out preference that resets on next visit is non-compliant. Both violations expose the business to the same enforcement actions as having no opt-out at all, and class-action plaintiffs specifically look for this pattern.

Add the required footer link and implement a persistent opt-out page at /do-not-sell. Gate every advertising pixel on the stored opt-out preference — client-side before pixels load, and server-side before any API calls to ad platforms.

// components/layout/footer.tsx — required link
<a href="/do-not-sell">Do Not Sell or Share My Personal Information</a>

// lib/analytics.ts — gate all pixels on preference
function isCCPAOptedOut(): boolean {
  if (typeof document === 'undefined') return false
  return document.cookie.includes('ccpa_opt_out=1') ||
    (typeof navigator !== 'undefined' && navigator.globalPrivacyControl === true)
}

export function loadThirdPartyPixels() {
  if (isCCPAOptedOut()) return
  loadFacebookPixel()
  loadGoogleAdsRemarketing()
}

Store the preference in a one-year cookie (max-age=31536000) and, for authenticated users, persist it server-side so the opt-out survives device changes. Confirm the page works without login.