Do Not Sell or Share link: missing or not working

The rule

Under Section 1798.140(ad) and (ah), “sell” and “share” are not limited to payment, and the enforcement record treats advertising tags that send visitor data to third parties as sale or sharing. The statute applies to a “business” that does business in California and meets one of three thresholds: annual gross revenue above $25,000,000 as adjusted, buying, selling or sharing the data of 100,000 or more consumers or households, or earning 50 percent or more of revenue from selling or sharing. The CPPA’s inflation notice puts the revenue figure at $26,625,000 from 1 January 2025. The 100,000 threshold is the one a smaller site with a lot of traffic can cross.

The regulations fill in the link. Section 7013 asks for a conspicuous link in the header or footer of the homepage, and Section 7003(c) says a required website link “shall appear in a similar manner as other similarly-posted links used by the business on its homepage(s).”

A link that exists is not enough. Section 7026(a)(4) addresses a common shortcut in direct terms.

The statute states penalties in two places: administrative fines of up to $2,500 for each offence, or $7,500 for each intentional one and each one involving the data of consumers known to be under 16, in Section 1798.155(a), and civil penalties in the same amounts in Section 1798.199.90(a) for actions brought by the Attorney General. Both are inflation-adjusted. The CPPA’s notice puts them at $2,663 and $7,988 from 1 January 2025, and the next adjustment falls in January 2027. The Attorney General’s August 2022 Sephora announcement said the CCPA’s notice and cure provision would expire on 1 January 2023.

What PeekWell checks and how

US-02 is run where the site’s markets include California. It asks two questions: do trackers that point to sale or sharing appear on the page, and if so, is there a link that opens a working opt-out?

The scan loads a public page in a fresh browser with no saved choices and records the network requests and cookies. Request domains are matched against a maintained list of advertising and cross-site tracker signatures. If a match appears, the scan looks in the page for a link with the Do Not Sell or Share title and follows it to see that it resolves. It then looks at the page it reaches for a form set up to send the request. A tracker with no link, a link that does not resolve, or a page with no working form each become a finding, with the requests and the link target as evidence.

A person has to read the result with the alternatives in mind. The regulations allow a business to honour opt-out signals in a frictionless way instead of using the standard link, or to use the Alternative Opt-out Link, so a missing standard link is a prompt to check what the site does, not an answer on its own. US-03 covers the signal side.

Code makes the decision from what the browser saw. A language model never decides that a tracker ran or that a link is missing.

The scan has limits, and the report says so. It sees public pages and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. The decision on whether an opt-out actually stops selling and sharing needs deeper or authorised testing, which a passive scan cannot do, so the scan checks the link, where it leads and that the form is set up to send. It does not read your contracts or know what a tag does beyond the category on its list, and a list only knows the trackers on it. Sharing that happens on a server is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

In February 2026 the Attorney General announced a $2.75 million settlement with Disney. The allegation was that a visitor could use a toggle, a webform or a browser signal and the selling and sharing continued from other devices, services, or through third-party ad-tech code. Healthline’s settlement in July 2025 for $1.55 million turned on data that, the Attorney General said, kept going to advertising third parties after a consumer opted out. The CPPA’s Tractor Supply decision, announced on 30 September 2025, listed the lack of an effective opt-out mechanism among the allegations the company agreed to resolve by paying a $1,350,000 fine, alongside privacy notice failures.

The CPPA made the same point in its May 2025 Todd Snyder decision. The Enforcement Division alleged the company’s privacy portal was not configured so as to process opt-out requests for 40 days, and its head said that “using a consent management platform doesn’t get you off the hook for compliance.” The Stipulated Final Order the CPPA Board adopted on 27 February 2026 alleged that PlayOn’s phone and email opt-out methods did not reach the tracking technologies on its sites. PlayOn did not admit liability.

The link, the form behind it and the suppression that follows are three separate things, and the record shows gaps in each.

Smaller companies and larger companies

The rule is the same for every business that meets the thresholds. What changes is how the gap appears.

In a small business the site is often a template or hosted builder. Someone adds an advertising pixel for a campaign and a banner plugin goes on. No one adds the link, or it points to an email address, or it opens an empty page. The 100,000 consumers-or-households threshold depends on traffic, not revenue, so a small site can be in scope. We could not confirm a decision against a clearly small business, and the note under the cases says so.

In a larger business the difficulty is coverage. A tag manager holds dozens of tags owned by different teams, the company has several brands, apps and connected TV products, and the opt-out has to reach all of it. Disney is the example on the record. Each opt-out method worked in part, and none stopped everything.

How to fix it

1. List what shares data. In a private window with the network tab open, load the homepage and a few key pages. Write down every third-party advertising, retargeting and cross-site analytics request. Those are the tools the opt-out has to control.
2. Add the link with the exact title. Put “Do Not Sell or Share My Personal Information” in the footer of the homepage, styled like the other footer links. If you offer a combined choice with the sensitive-data link, label it so it is clear what it does.
3. Point it at a page that works. The page needs a form or control a visitor can use without an account or extra personal details. A cookie banner or an email address on its own does not address the selling and sharing.
4. Wire the request to the tags. When a visitor opts out, the advertising and cross-site tags have to stop for that browser, and the request has to reach your ad vendors and your tag manager rules. Test with a fresh browser after you submit it.
5. Cover every product. Apps, connected TV, other brands and logged-in accounts need the same result.
6. Honour the signal too. Websites are expected to accept a browser opt-out signal as well as offering a form. US-03 walks through that step.
7. Re-scan. Run a scan again once the link and suppression are live. The finding should clear when the link opens and the page behind it works.

Whether this meets the law for your business is a question for your legal adviser. Peeky reports only what it sees.