Businesses that sell personal information are subject to the CCPA’s requirement to provide a clear and conspicuous “Do Not Sell My Personal Information” link on their website that allows website visitors to submit an opt-out request. Businesses cannot require visitors to create an account to submit the request. With some exceptions, businesses cannot sell personal information after receiving an opt-out request unless a visitor later provides authorization allowing them to do so again.
Businesses can only sell the child’s personal information that they know to be under the age of 16 if they get affirmative authorization (“opt-in”) for the sale of the child’s personal information. For children under the age of 13, opt-in must come from the child’s parent or guardian. For children at least 13 years old but under the age of 16, the opt-in can come from the child.
While businesses are not required to verify that the person submitting an opt-out request is really the consumer for whom the business has personal information, they may need to ask for additional information to make sure they stop selling the right person’s personal information. If the business asks for personal information to verify the visitor’s identity, it can only use that information for this verification purpose.
There are some exceptions to the opt-out right. Common reasons why businesses may refuse to stop selling personal information include:
- If a sale is necessary for the business to comply with legal obligations, exercise legal claims or rights, or defend legal claims.
- If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA
See Civil Code section 1798.145 for more exceptions.
