Requests to Opt-in After Opting-out of the Sale or Sharing of Personal Information or Limiting the Use and Disclosure of Sensitive Personal Information

What it requires

Opting back in to sale or sharing, or to wider use of sensitive personal information, takes a two-step process: the consumer first clearly requests it and then separately confirms the choice. When a consumer who has opted out starts a transaction that needs sale or sharing, the business may say so and explain how to consent, but it must obtain that consent under the § 7004 rules for symmetrical, dark-pattern-free choices.

Regulation text

(a) Requests to opt-in to sale or sharing of personal information and requests to opt-in to the use and disclosure of sensitive personal information shall use a two-step opt-in process whereby the consumer shall first, clearly request to opt-in and then second, separately confirm their choice to opt-in. (b) If a consumer who has opted-out of the sale or sharing of their personal information initiates a transaction or attempts to use a product or service that requires the sale or sharing of their personal information, the business may inform the consumer that the transaction, product, or service requires the sale or sharing of their personal information and provide instructions on how the consumer can provide consent to opt-in to the sale or sharing of their personal information. The business shall comply with section 7004 when obtaining the consumer’s consent.

California Consumer Privacy Act / California Privacy Rights Act, § 7028Read the full section from California Privacy Protection Agency (CalPrivacy)