Consumers’ Right to Opt Out of Sale or Sharing of Personal Information

What it requires

Consumers have the right to direct a business not to sell or share their personal information with third parties. This right must be prominently disclosed in the privacy policy. Businesses may not sell or share personal information of consumers under 16 without opt-in consent (under 13 requires parental consent). Once a consumer opts out, the business must honor the direction unless the consumer subsequently provides consent. Since AB 1824 took effect January 1, 2025, subdivision (a)(2) carries that opt-out with the data: a business that receives personal information as an asset in a merger, acquisition, bankruptcy, or other transaction in which it assumes control of all or part of the transferor must comply with the direction the consumer gave the transferor.

Statute text

(a)(1) A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. This right may be referred to as the right to opt out of sale or sharing. (2) A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the transferee assumes control of all of, or part of, the transferor shall comply with a consumer’s direction to the transferor made pursuant to this subdivision. [...] (c) Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

California Consumer Privacy Act / California Privacy Rights Act, § 1798.120Read the full section from California Privacy Protection Agency (CalPrivacy)

How Privisy tests it