The California Consumer Privacy Act (CCPA) provides California residents the right to opt-out of the sale or sharing of their personal information. "Selling" under the CCPA means making personal information available to a third party in exchange for valuable consideration (including free or discounted software). "Sharing" means using consumers' personal information for "cross-context behavioral advertising," i.e., interest-based advertising.

As a business, you will have to determine if you sell or share personal information under the CCPA, such as through the use of interest-based advertising. If you are selling or sharing information, you must provide California consumers with a way to opt-out.

Why You Need to Track Advertising Opt-Outs

If you use interest-based advertising, you’ll want to ensure web visitors can opt out of having their information shared with ad networks. Doing so helps you build trust with customers and web visitors through transparent consent-based privacy practices. Additionally, non-compliance with the CCPA may result in monetary penalties. Read about why it’s better to get compliant sooner rather than later.

Opt-out tracking isn’t just required by the law, it’s also good business practice. By recording the specific dates that requests were made, you can schedule a request to ask the consumer to opt-in again after 12 months.

How Do I Fulfill My CCPA Obligations?

There is no one perfect way to track opt-outs but you’ll want to consider a variety of methods to determine what works best for you.

• Find out if your ad networks provide solutions to help you comply with the CCPA. For example, Facebook’s Limited Data Use (LDU), or Google’s Restricted Data Processing (RDP) can help you provide website visitors with a way to opt out. These settings, when enabled, change the way these services process data. The easiest way to learn about these solutions is to search the vendor or ad network name along with the phrase “ccpa opt out”.
• Include a conspicuous link titled “Do Not Sell or Share My Personal Information” on your website that leads to a form and/or directions that your customers can follow to submit a request to opt-out. You may need to provide multiple sets of directions for opting out depending on the type of selling or sharing that you do.
  • The most direct way way to track and manage cookie opt-outs is to use a custom plug-in or third party cookie opt out tool on your website. This is something that your website development team should review and implement. The plug-in or opt out tool should give the customer control over what information they share through the website and should provide you with a log of requests for your records.

• • Some types of interest-based advertising require that your business “sell” personal information, like a name and email address. Sharing names and email addresses with ad networks is common practice for advertising services like lookalike audiences. If you participate in this type of selling, you will have to create a process that removes people who have opted out from the list of names and emails you share with ad networks. You may need to email the ad network directly to understand how to best honor an opt out request.
  • Other methods of opt-outs you could offer include receiving requests through an email address or physical mailing address. Businesses also have the option to provide a toll-free number that consumers may call to make requests.