Opt-out requests processed within 15 business days

CCPA § 1798.120(c) and § 1798.135(b) require opt-out requests to be processed within 15 business days of receipt. For real-time client-side opt-outs — a cookie is set and pixels stop firing immediately — this deadline is automatically satisfied. The gap is backend-processing opt-outs: requests that require staff to remove the consumer from a CRM, advertising platform audience, or data broker list. Without a tracking system and documented SLA, there is no way to prove compliance, and regulators treat the absence of tracking as evidence of non-compliance. An opt-out form that routes to an unmonitored inbox with no SLA is a CCPA violation waiting for an enforcement trigger.

For real-time cookie-based opt-outs, document that the 15-day deadline is satisfied automatically. For any backend processing (removing from CRM lists, third-party advertising audiences), persist an opt-out record with a timestamp and send the consumer a confirmation email.

// app/api/privacy/opt-out/route.ts — log, confirm, and schedule third-party removal
export async function POST(req: Request) {
  const { email } = await req.json()

  await db.privacyPreference.upsert({
    where: { email },
    create: { email, optedOutAt: new Date(), type: 'sale_sharing' },
    update: { optedOutAt: new Date() },
  })

  await sendEmail({
    to: email,
    subject: 'Your opt-out has been processed',
    body: 'Effective immediately. Third-party advertising lists updated within 15 business days.',
  })

  await notifyThirdPartiesOfOptOut(email)
  return Response.json({ ok: true, processedAt: new Date().toISOString() })
}

Track third-party list removals in PRIVACY_OPERATIONS.md so you can demonstrate the 15-business-day SLA was met if a regulator asks.