Do Not Sell Is Not Do Not Share: The Two Links and the Sale Between Them
The footer link says Do Not Sell My Personal Information. The site never sells anything. It shares data with an ad network on every page load, which is the act the link does not name. The visitor who clicks it has exercised the wrong right, and the business that posted it has promised the wrong thing. California's rules cover sale and sharing as two different acts, and the link text has to match what the business actually does.
The confusion is understandable because the old link text predates the current law. The CCPA as amended by the CPRA covers the sale of personal information and the sharing of personal information for cross-context behavioral advertising. Sale means exchanging data for money or other valuable consideration. Sharing means disclosing it for cross-context behavioral advertising, whether or not money changes hands. A site that sends data to an ad network for behavioral ads is sharing even if it never takes a dollar for the data.
The three verbs in the regulation
Privacy law now runs on statutory verbs, and the verbs are precise: sale, sharing, and cross-context behavioral advertising. The opt-out right covers all of them, and the GPC signal covers them too. A business that sells or shares personal information must treat a GPC signal as a valid opt-out for that browser or device and any linked profile. The signal does not distinguish between the two acts. The footer link should not pretend they are one act either.
The current link text most teams use is "Do Not Sell or Share My Personal Information," and that pairing exists because the law pairs them. A site that only shares should still use the paired wording or the "Your Privacy Choices" alternative the regulations allow, because the visitor cannot be expected to know whether the site's ad-tech deal is a sale or a share. The business knows. The link should reflect what the business knows.
The frictionless route, and its conditions
Section 7025 gives a business a choice. Process the signals and post the links, or process signals in a frictionless manner and omit the links if the section 7025(g) conditions are met. The frictionless route is real, and it is the reason some large sites have no Do Not Sell link at all. But it is conditional, and posting the links instead of honoring the signals is not an option. A site that omits the links without meeting the conditions has removed the fallback and kept the violation.
The Disney settlement from February 2026 is the cautionary tale for the link itself. The $2.75 million settlement turned on details: GPC opt-outs limited to a single device even when the consumer was logged in, and opt-out tools that did not reach embedded third-party ad-tech. The link was not the problem. The honoring behind the link was. A correct link over a broken opt-out is still a broken opt-out, and regulators test the honoring, not the footer.
What to put in the footer
Check three things. First, does the business sell, share, or both, and does the link text say so. Second, does the link work without a login, without a form, and without a confirmation email. Third, does clicking it actually stop the sale or sharing, including in the embedded pixels. If the link is right and the honoring is broken, fix the honoring. If the honoring is right and the link names the wrong act, fix the link. The visitor should not need a law degree to exercise a right the law gave them in plain words.
Keep reading: CMP Free Plans: What the Free Tier Quietly Leaves Out, Your A/B Test Needs Consent First: The Testing Cookies Nobody Banners, The Reject Button That Does Not Survive Navigation cover the nearby cases in this series.
Frequently asked questions
What is the difference between sale and sharing under CCPA?
Sale means exchanging personal information for money or other valuable consideration. Sharing means disclosing it for cross-context behavioral advertising, whether or not money changes hands. A site that sends data to an ad network for behavioral ads is sharing even if it never takes a dollar for it.
Do we need a Do Not Sell link if we do not sell data?
If you share data for cross-context behavioral advertising, yes, you need an opt-out path, and the paired wording Do Not Sell or Share fits. If you neither sell nor share, the section 7025 duty does not apply, but the link is cheap insurance against a wrong scope call.
Can we skip the links entirely?
Yes, if you process opt-out preference signals in a frictionless manner and meet the section 7025(g) conditions. Posting the links instead of honoring the signals is not an option, and omitting the links without meeting the conditions leaves visitors with no fallback.
How does GPC relate to the link?
GPC is a browser signal that counts as an opt-out request under 11 CCR section 7025. The link is the manual path for visitors who never send the signal. A site must honor the signal automatically and offer the link for everyone else.