Must every business show a Do Not Sell or Share link?

No. The duty depends on whether the covered business sells or shares personal information and whether an allowed alternative applies, including qualifying frictionless opt-out preference signal processing.

Is Limit the Use of My Sensitive Personal Information always required?

No. It applies when a covered business uses or discloses sensitive personal information beyond purposes permitted without the right to limit.

Legal & Compliance

California Privacy Choice Links: Do Not Sell or Share and Limit Use

California gives consumers distinct controls over sale or sharing of personal information and certain uses or disclosures of sensitive personal information.

Permitted control patterns

The regulations describe conspicuous “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” links, an approved alternative privacy-choice link, and circumstances where frictionless processing of an opt-out preference signal affects the link requirement. The privacy policy must also explain applicable rights and how to exercise them.

This conditional structure matters. A scanner should not say a site violates the CCPA merely because one exact English phrase is absent. The business may not engage in the triggering practice, may use another allowed interface, or may process browser signals in the specified frictionless manner.

What AllyProof checks

From California, AllyProof looks for semantically equivalent sale/share and sensitive-information controls across languages, follows candidate controls, and compares them with the site's visible disclosures and GPC response. Missing or ambiguous controls are normally surfaced for review unless the captured evidence supports a stronger finding.

Official sources

Whether a choice link is required depends on the business's actual sale, sharing, and sensitive-information practices. Confirm those facts before treating interface evidence as a legal conclusion.

Common questions

Must every business show a Do Not Sell or Share link?: No. The duty depends on whether the covered business sells or shares personal information and whether an allowed alternative applies, including qualifying frictionless opt-out preference signal processing.
Is Limit the Use of My Sensitive Personal Information always required?: No. It applies when a covered business uses or discloses sensitive personal information beyond purposes permitted without the right to limit.

Want to review these signals on your own website?

Run a free compliance check