CCPA/CPRA § 1798.135
Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information
The Privisy audit tests this section. See the checks
- Source
- Statute
- In force from
- January 1, 2025
- Last reviewed
- September 2026
- Framework
- CCPA/CPRA
What it requires
A business that sells or shares personal information (or uses/discloses sensitive PI beyond § 1798.121(a) purposes) must provide the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or a single link to both choices (subdivision (a)). Subdivision (b)(1) exempts a business that lets consumers opt out via an opt-out preference signal. Subdivision (c)(4) requires the business to honor an opt-out and wait at least 12 months before requesting that the consumer re-authorize the sale or sharing of their personal information or the additional use of their sensitive personal information.
Statute text
(4) For consumers who exercise their right to opt out of the sale or sharing of their personal information or limit the use or disclosure of their sensitive personal information, refrain from selling or sharing the consumer’s personal information [...] and wait for at least 12 months before requesting that the consumer authorize the sale or sharing of the consumer’s personal information [...].
California Consumer Privacy Act / California Privacy Rights Act, § 1798.135Read the full section from California Privacy Protection Agency (CalPrivacy)
How Privisy tests it
- Do Not Sell or Share Link
Statutory link duty; § 1798.135(b)(1) frictionless-signal exemption
- Global Privacy Control (GPC) Signal
Opt-out preference signal alternative (§ 1798.135(b)(1))
- GPC Re-Opt-In Request (§ 1798.135(c)(4))
12-month wait before re-requesting authorization (§ 1798.135(c)(4))
- Policy: Authorized Agent Instructions
Consumers may authorize another person to opt out on their behalf (§ 1798.135(e))
- Policy: Opt-Out Preference Signal Disclosure
Statement that the business abides by opt-out preference signals (§ 1798.135(b)-(c)(2))
The audit runs these checks against your live site and shows the evidence behind every result.
Get Your AuditThis page is for information only and is not legal advice. The excerpt is reproduced from official public sources and was checked against them on the last-reviewed date above. Laws change: check the authoritative source and consult a licensed attorney for compliance guidance.