Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information

What it requires

A business that sells or shares personal information (or uses/discloses sensitive PI beyond § 1798.121(a) purposes) must provide the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or a single link to both choices (subdivision (a)). Subdivision (b)(1) exempts a business that lets consumers opt out via an opt-out preference signal. Subdivision (c)(4) requires the business to honor an opt-out and wait at least 12 months before requesting that the consumer re-authorize the sale or sharing of their personal information or the additional use of their sensitive personal information.

Legal text (excerpt)

(4) For consumers who exercise their right to opt out of the sale or sharing of their personal information or limit the use or disclosure of their sensitive personal information, refrain from selling or sharing the consumer’s personal information [...] and wait for at least 12 months before requesting that the consumer authorize the sale or sharing of the consumer’s personal information [...].

Primary source

Privisy checks

The following Privisy scanner checks are grounded in this citation:

• Do Not Sell or Share Link

  Statutory link duty; § 1798.135(b)(1) frictionless-signal exemption

• Global Privacy Control (GPC) Signal

  Opt-out preference signal alternative (§ 1798.135(b)(1))

• GPC Re-Opt-In Request (§ 1798.135(c)(4))

  12-month wait before re-requesting authorization (§ 1798.135(c)(4))

• Policy: Authorized Agent Instructions

  Consumers may authorize another person to opt out on their behalf (§ 1798.135(e))

• Policy: Opt-Out Preference Signal Disclosure

  Statement that the business abides by opt-out preference signals (§ 1798.135(b)-(c)(2))