CCPA Do Not Sell Rule: What it Means for You

The CCPA Do Not Sell rule gives consumers the right to opt out of the sale of their personal information. Here's how to make sure you comply.

Casey Hill · August 8, 2019

Starting January 1, 2020, the California Consumer Privacy Act (CCPA) will be in effect for California residents, requiring companies that conduct business in California to make structural changes to their privacy programs.  

The new consumer rights, such as the right to opt out of the sale of your personal information, require organizations to:  

  • Develop an efficient way to process and respond to consumer requests to exercise their new rights to opt out 
  • Maintain detailed, ongoing records for compliance 

Under the CCPA, all consumers have the right to opt out of the sale of their personal information. This is enabled by adding a “Do Not Sell My Personal Information” link to your homepage and privacy policy.  

Organizations can direct consumers to a customizable web form, allowing them to opt out of the sale of their personal information. Moreover, organizations should have a way to verify that they are effectively respecting consumers’ “Do Not Sell” requests, as well as documenting the details in the process. 

When pressing “Do Not Sell My Data,” users should be directed to a web page that enables users to opt of the sale of their personal information.   

12-month look-back rule  

Under the CCPA, when a consumer makes a verifiable request for access to their personal information, organizations are required to provide records covering the 12-month period preceding the date of the request. This means that your organization should already be maintaining accurate records of consumers’ personal information starting from January 1, 2019. 

CookiePro Do Not Sell Solutions   

Cookie Consent Notice  

For organizations that sell or purchase behavioral tracking data via cookies, CookiePro helps prevent the unlawful sale of this type of consumer information. With CookiePro, your organization can also display various cookie consent notices based on the location of the consumer (e.g. notice-only cookie banner for California and opt-in banner for the EU).   

Website Scan  

When responding to requests for information and deletion, organizations will also need to know which cookies and other tracking technologies are associated with each person. CookiePro’s scanning tool allows you to scan your website to automatically detect cookies and other tracking technologies, generate a detailed cookie notice, and provide a cookie preference center for visitors to granularly select which types of cookies consumers can enable or disable.   

Records of Consent  

Lastly, CookiePro helps organizations maintain records of consent through a preference management center. Organizations can embed a link to allow consumers to opt out of the sale of their personal information. This empowers consumers to take more control over their settings, creating a better experience and more personalized marketing. 

Regardless of the maturity of your privacy program, it’s never too soon to start planning for your CCPA readiness.