Third-party sharing stops when consumer opts out

Recording an opt-out preference without actually stopping data sharing is a CCPA § 1798.120 violation more egregious than having no opt-out at all — it deceives the consumer into believing their request was honored. The most common pattern: opt-out cookie is set correctly, suppressing one pixel (e.g., Facebook), while server-side Segment track() calls or a Google Analytics identify() still fire unconditionally because they were wired into API route handlers that never check the opt-out flag. Each page load where a third-party sharing call fires for an opted-out consumer is a separate violation. This check requires tracing the enforcement gap, not just the preference storage.

Create a centralized isUserOptedOut() helper that both client-side pixels and server-side analytics calls must pass through. Enumerate every third-party sharing touchpoint and confirm each one is gated.

// lib/analytics.ts — single source of truth for opt-out check
import { cookies } from 'next/headers'

export async function isUserOptedOut(userId?: string): Promise<boolean> {
  if (userId) {
    const pref = await db.privacyPreference.findFirst({ where: { userId, type: 'sale_sharing' } })
    if (pref) return true
  }
  const cookieStore = cookies()
  return cookieStore.get('ccpa_opt_out')?.value === '1'
}

// Server-side event — every analytics call uses this wrapper
export async function trackServerEvent(event: string, props: Record<string, unknown>, userId?: string) {
  if (await isUserOptedOut(userId)) return
  await segment.track({ event, properties: props, userId })
}

Search src/ for segment.track, gtag, fbq, analytics.identify, and mixpanel.track calls and confirm each one is wrapped or gated. Document the gating coverage in PRIVACY_OPERATIONS.md.