Opt-Out Confirmation: Means for the Consumer to Confirm Processing

What it requires

The companion duty to § 7025(c)(6), and likewise a "may" that the Register 2025, No. 39 amendments turned into a "must" effective January 1, 2026: a business must provide a means by which the consumer can confirm that their request to opt-out of sale/sharing has been processed. The regulation gives two example forms — an on-page display ("Consumer Opted Out of Sale/Sharing") or the opt-out state shown in the consumer's privacy settings through a toggle or radio button. The duty covers every request to opt out, not only those sent as an opt-out preference signal, so a business that honors a footer-link opt-out silently now owes the consumer a receipt as well.

Legal text (excerpt)

A business must provide a means by which the consumer can confirm that their request to opt-out of sale/sharing has been processed by the business. For example, the business may display on its website "Consumer Opted Out of Sale/Sharing" [...] or display in the consumer's privacy settings through a toggle or radio button that the consumer has opted out of the sale/sharing of their personal information.

Primary source

Privisy checks

The following Privisy scanner checks are grounded in this citation:

• GPC Status Display

  The toggle or radio-button form of the opt-out confirmation the detector accepts