Clear "Do Not Sell or Share My Personal Information" link in website footer
Why it matters
CCPA § 1798.135(a)(1) mandates that businesses that sell or share PI place a "Do Not Sell or Share My Personal Information" link — the statute specifies this exact text — conspicuously in the website footer, accessible on every page. A link only on the marketing homepage that disappears once users enter the authenticated app is non-compliant. Missing the exact statutory text (using "Privacy Choices" alone, for example) is also non-compliant. The footer link is often the first thing a CPPA investigator checks; its absence is a clear-cut violation requiring no further investigation to establish.
Severity rationale
High because the footer link is an explicit statutory requirement under CCPA § 1798.135(a)(1) — its absence is a standalone violation regardless of whether an opt-out mechanism exists elsewhere.
Remediation
Add the link to your site-wide footer component, not just a marketing layout, so it appears in the authenticated application experience.
// components/layout/SiteFooter.tsx
export function SiteFooter() {
return (
<footer className="border-t py-8">
<div className="container mx-auto flex flex-wrap gap-4 text-sm text-muted-foreground">
<a href="/privacy">Privacy Policy</a>
<a href="/terms">Terms of Service</a>
{/* Required by CCPA § 1798.135(a)(1) if you sell or share PI */}
<a href="/do-not-sell">Do Not Sell or Share My Personal Information</a>
</div>
</footer>
)
}
Import SiteFooter in your root app/layout.tsx, not just app/(marketing)/layout.tsx. Confirm the link renders on authenticated dashboard pages in addition to public marketing pages. If space is tight, the approved short form is "Do Not Sell or Share" — anything shorter is non-compliant.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CCPA/CPRA Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- ccpa · §1798.135(a)(1) — Required "Do Not Sell or Share My Personal Information" footer link
- ccpa · §1798.120(b) — Opt-out right — link must be conspicuous on homepage and in privacy policy
- gdpr · Art. 21(2) — Right to object to direct marketing — must be clearly presented
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ccpa-readiness·automated