Opt-out mechanism functional, easy to use, no account required

CCPA § 1798.120(a) grants every consumer — not just authenticated users — the right to opt out of the sale or sharing of their personal information. § 1798.135(a)(2) explicitly prohibits businesses from requiring consumers to create an account or log in to exercise this right. An opt-out page that returns a 404, requires authentication, stores the preference in sessionStorage only, or resets on next visit fails on multiple statutory requirements simultaneously. These failures also cannot be fixed client-side at runtime — they require a working deployment, an accessible route, and persistent server-side storage as the fallback when cookies are cleared.

Verify the /do-not-sell route is deployed and returns a 200, works without authentication, stores preference in a one-year cookie (not sessionStorage), and displays an immediate confirmation.

// app/do-not-sell/page.tsx — no auth required, persistent storage, clear confirmation
'use client'
import { useState } from 'react'

export default function DoNotSellPage() {
  const [done, setDone] = useState(false)

  async function optOut() {
    document.cookie = 'ccpa_opt_out=1; max-age=31536000; path=/; SameSite=Lax; Secure'
    try { await fetch('/api/privacy/opt-out', { method: 'POST' }) } catch {}
    setDone(true)
  }

  return (
    <main>
      <h1>Do Not Sell or Share My Personal Information</h1>
      <p>No account required to exercise this right (CCPA § 1798.120).</p>
      {done ? (
        <div role="alert"><strong>Opt-out recorded.</strong> Preference saved for one year.</div>
      ) : (
        <button onClick={optOut}>Opt Out of Sale/Sharing</button>
      )}
    </main>
  )
}

Test the route with a fresh incognito session — no cookies, no login — and confirm the button works and the confirmation renders.