GPC vs Do Not Sell Links: Two Obligations, Not a Choice

Two different things get called "the opt-out" in a CCPA conversation. One is a link in the footer that a person finds and clicks. The other is a machine-readable preference that a browser attaches to every request it makes, before anyone has read a word of the page. They are written into different parts of California law, they reach different visitors, and a site can satisfy one of them completely while failing the other.

The question that keeps surfacing is whether honoring Global Privacy Control lets a business take the Do Not Sell or Share My Personal Information link off the page. There is a real answer, and it is narrower than either of the two versions people usually repeat. The regulations do describe a path where the posted link comes down, but that path carries conditions, and none of those conditions reduce the duty to honor the signal. Here is what each mechanism has to do, and where the single narrow exception sits.

Two mechanisms, two sections

The posted link is a creature of Civil Code § 1798.135 and 11 CCR § 7013. The signal is a creature of 11 CCR § 7025. That separation is the whole story in miniature: these are not two readings of one rule, they are two rules.

§ 1798.135(a) says that a business selling or sharing personal information, or using or disclosing sensitive personal information beyond the purposes § 1798.121(a) allows, must provide a "Do Not Sell or Share My Personal Information" link and a "Limit the Use of My Sensitive Personal Information" link, or a single link to both choices. § 7013 places that link in the header or footer of the homepage and attaches a notice to its destination.

§ 7025 says something structurally different. A business that sells or shares must treat any qualifying opt-out preference signal as a valid request to opt out of sale and sharing for that browser or device, and for any consumer profile associated with it, including pseudonymous profiles. Nobody clicks anything. The request is made by the browser, on every page load, whether or not the visitor ever scrolls to the footer.

Those two populations barely overlap. The link serves the person who goes looking for a control. The signal serves the person whose browser already speaks for them and who will never look for one. Serving one group well says nothing about the other.

What the Do Not Sell or Share link has to do

The requirements are specific, and most of them are visual:

• Conspicuous, in the header or footer of the homepage. § 7013 requires the "Do Not Sell or Share My Personal Information" link to be a conspicuous link located at either the header or the footer of the business's internet homepage. A control buried three screens deep in account settings is not this link.
• A destination carrying the Notice of Right to Opt-out. Under § 7013 that notice must be posted at the webpage the link leads to, or within the privacy policy. The link is the entry point, not the disclosure itself.
• Sensitive personal information covered too. § 1798.135(a) pairs the sale and sharing link with a "Limit the Use of My Sensitive Personal Information" link, and permits a single link to both choices in place of two.
• A twelve-month wait after an opt-out. § 1798.135(c)(4) requires the business to honor the opt-out and wait at least twelve months before requesting that the consumer re-authorize the sale or sharing of their personal information, or the additional use of their sensitive personal information. An opt-out is not an invitation to renegotiate on the next visit.

Every one of those is checkable by a person looking at a page. That is what makes the link the easy half of this article, and it is also why the link so often gets treated as the whole obligation.

What the GPC signal has to do

§ 7025 carries the signal obligation, and its own text ties it back to the statute: the business shall treat the opt-out preference signal as a valid request to opt out of sale and sharing submitted under Civil Code § 1798.120 for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles. It is the same right, arriving through a different door.

The second half of the obligation is the one that surprises people. § 7025(c)(6) requires a business to display on its website whether it has processed the signal as a valid opt-out request. The regulation's own examples are a message reading "Opt-Out Request Honored", or a toggle or radio button showing that the consumer has opted out. Blocking every affected tracker correctly and then saying nothing about it leaves this half unmet.

One note for anyone working from an older reading of the section: the Register 2025, No. 39 amendments, operative January 1, 2026, updated subsections (c)(3) through (c)(4), (c)(6), and (f)(3). The parts of § 7025 dealing with conflicts, status display, and frictionless processing are the recently revised ones.

The Alternative Opt-Out Link

§ 7015 offers a third piece of page furniture, and it carries a two-part requirement that is easy to half-implement. A business choosing to use the Alternative Opt-out Link must title the link "Your Privacy Choices" or "Your California Privacy Choices", and must include the official CPPA opt-out icon adjacent to the title. Both elements are required. The title on its own is not the Alternative Opt-Out Link, and neither is the icon on its own.

Like the link it stands in for, it must be a conspicuous link in the header or footer of the homepage. Its destination has to be a webpage where the consumer can exercise both the right to opt out of sale and sharing and the right to limit the use of sensitive personal information. That combined destination is the point of it: § 7013 permits the Alternative Opt-out Link in lieu of the Do Not Sell or Share link, so a business taking this route is folding two posted controls into one.

The one place they interact: frictionless processing

This is the part worth reading twice. § 7013 says that in lieu of the "Do Not Sell or Share My Personal Information" link, a business may instead provide the Alternative Opt-out Link under § 7015, or process opt-out preference signals in a frictionless manner under § 7025(f) and (g). § 1798.135(b)(1) does the same work at the statutory level: it exempts a business that lets consumers opt out via an opt-out preference signal from the subdivision (a) link requirement. So it is not accurate to say the posted link is always mandatory. That path is real.

What it costs is set out in § 7025(f)(3). Under frictionless processing a business may not display any notification, pop-up, text, graphic, animation, sound, video, or interstitial content in response to the opt-out preference signal. There are two exceptions and only two: the business may display whether the visitor has opted out, and it may provide a link to a privacy settings page through which the consumer can consent to the business ignoring the signal. Anything else that appears on screen because the signal arrived is friction.

Read the carve-out for exactly what it does. It removes the posted link. It does not remove the duty to honor the signal, because the exemption exists precisely on the basis that the signal is being processed. The moment the processing stops being real, the ground the exemption stood on is gone, and nothing else was satisfying the link duty in the meantime. In the shortest form: honoring GPC never excuses ignoring a click on the link, and posting the link never excuses ignoring the signal.

Three ways this gets read wrong

1. "We honor GPC, so we removed the link." The exemption is conditioned on frictionless processing, not on the intention to honor the signal. A site that reads GPC and then presents a confirmation banner announcing what it just did has displayed a notification in response to the signal, which is the specific thing § 7025(f)(3) prohibits. Displaying opt-out status is permitted; an interstitial announcement is not. Where the processing is not frictionless, the § 7013 and § 1798.135(b)(1) route is not available, and the posted link should still be on the page.
2. "We have the link, so the signal is optional." The § 7025 obligation is not conditioned on the absence of a link. It applies to a business that sells or shares personal information, and it applies on every request that carries a qualifying signal. California's first public CCPA settlement made the point in the most expensive way available: in August 2022 the California Attorney General settled with Sephora Inc. for $1,200,000 over conduct that included failing to honor Global Privacy Control opt-out signals and failing to cure the violations within the CCPA's thirty-day cure period.
3. "The saved setting wins." § 7025(c)(3) covers the case where a signal conflicts with a business-specific privacy setting that allows sale or sharing, and it resolves against the stored setting: the business must process the signal as a valid opt-out request. It may notify the consumer of the conflict and offer an opportunity to consent using the § 7004 consent procedures, and if the consumer consents it may ignore the signal for as long as that consumer is known to it. What it may not do is let the older stored preference win by default.

Checking what your site does today

The link is visible in a page's footer. Whether the signal is honored is not, which is what a free GPC check is for. It loads one URL with the Global Privacy Control signal set and reports whether third-party trackers still fire, which is the behavioural half that no amount of footer inspection can answer.

The rest is a reading exercise that takes a browser and a few minutes. Does the homepage carry the "Do Not Sell or Share My Personal Information" link, or the Alternative Opt-Out Link with both its title and the CPPA icon adjacent to it? Does the destination page carry the Notice of Right to Opt-out, or does the privacy policy? If the link has been dropped in favour of the frictionless route, does anything appear on a GPC visit beyond opt-out status and a link to privacy settings?

The behavioural half is where things drift. A configuration that passed review last quarter can stop passing after a theme change, a newly hardcoded tag in a template, or a widget that arrived with its own tracking attached, and none of those edits change anything in the footer. That is the argument for an outside read: a consent platform reports on the configuration it controls, while a load from a clean session reports on what the page actually did.

Outside California

The posted-link requirements in this article are California's. § 7013, § 7015, and § 1798.135 are a California regulation and a California statute, and the specific page furniture they describe does not transplant automatically to other states.

The signal obligation travels further. Several states fold recognition of a universal opt-out mechanism into their own statutes, each on its own date and in its own words, so it is worth reading how the other states word the same obligation before assuming a California-scoped program covers the rest of your traffic. The technical failure mode is identical in all of them: a tracker that keeps firing after the signal arrives.

Which leaves the work itself. Deciding what counts as sale or sharing, wiring the suppression into a tag manager, a server, or a consent platform, and then showing status without tripping over § 7025(f)(3) is a separate exercise from the one in this article, and it is covered in the implementation side of honoring the signal.