Do not sell my personal information is a link a great many sites now carry and rather fewer sites can honor. Putting it in the footer is twenty minutes of work. Making it true means knowing which of your tools receive personal data, being able to tell them to stop for one person, and reading a signal the visitor's browser sends before they have clicked anything at all.
Selling does not require money
This is the part that surprises people. California defines selling as disclosing personal information to another business for monetary or other valuable consideration, and sharing as disclosing it for cross-context behavioural advertising. An advertising pixel that receives a visitor identifier and returns better targeting is valuable consideration in both directions. No invoice is raised and no money moves, and the disclosure is still in scope. Which is why a site that has never sold a list in its life can still owe the link.
Where the link goes and what it has to say
A business that sells or shares personal information provides a clear and conspicuous link titled Do Not Sell or Share My Personal Information on its homepage, and a second link to limit the use of sensitive personal information where that applies. The statute allows a single combined link that takes the consumer to a page where they can exercise both. What it does not allow is a link that leads to an account sign-up, an email address you answer when you get round to it, or a form asking why they want to opt out.
The signal you never see a click for
Regulations require a business to treat an opt-out preference signal sent by a browser or extension as a valid request from that consumer. The Global Privacy Control is the one in circulation. It arrives as a header on the page request, before any interaction, and it means the visitor has opted out for every site they visit. Honouring it is not optional because you also offer a link, and it is the half nobody notices is broken, because a signal that is ignored produces no complaint and no support ticket.
Who else holds a copy
An opt-out that stops your own future disclosures but leaves the copies already sent sitting in three advertising platforms has done a fraction of the job. The obligation reaches the businesses you sold or shared the data with: they have to be told, so that they stop too. This is only possible if you keep a list of which tools receive what, which is the same list your privacy notice needs and the same list your access requests need. One record, three uses.
What a sale looks like in four ordinary stacks
A shop running an advertising pixel that receives hashed emails at checkout so that audiences can be built is sharing, whatever the invoice says. A publisher running programmatic advertising is almost certainly both selling and sharing, because the bid request carries identifiers to a long list of parties. A SaaS company with only analytics and error tracking, where nothing goes to an advertising platform, is usually doing neither. A business that appends data from a third-party provider is buying rather than selling, which is not the same duty, and it still has to disclose the source category. Working out which of those four you are is an afternoon with the tag list, and it is the question every other answer on this page depends on.
How to test that the opt-out actually works
Three tests catch nearly everything. Open the site in a browser with the Global Privacy Control signal enabled, load a page, and check in the network panel whether the advertising tags still fire; if they do, the signal is being received and ignored. Second, submit the opt-out yourself through your own link and then check each receiving platform for the suppression, rather than trusting that the request was forwarded. Third, wait a week and repeat the first test, because a tag manager change or a new app can quietly restore what the opt-out suppressed. Write the date of each test down; it is the only evidence that the link was ever more than a link.
Other questions people ask
We do not sell data. Do we still need the link?
If any tool on your site receives personal information for advertising purposes, you are probably sharing within the meaning of the statute even though nobody is paid. Count the tools before you decide you are exempt.
Can we ask them to log in first?
No. You may verify a request for deletion or access, but an opt-out of sale or sharing is meant to be low friction, and requiring an account to make one is itself a barrier the regulations treat as a defect.
What is the deadline?
Opt-outs of sale or sharing are meant to be acted on promptly, and in any case no later than fifteen business days from receipt, including telling the third parties who received the data in the ninety days before.
Does the link have to be on every page?
The statute names the homepage, and in practice the footer puts it on every page, which is what most businesses do because a visitor who lands on a product page should not have to navigate home to find it.
Does honouring the signal mean we cannot run ads at all?
No. It means you may not share that visitor's personal information for cross-context behavioural advertising. Contextual advertising, which targets the page rather than the person, is unaffected, and so is your own first-party marketing to people who gave you their details.
What do we do about data already sent to an ad platform?
Tell the recipients. The obligation reaches the businesses you sold or shared the data with in the preceding period, and most platforms expose a suppression or deletion endpoint for exactly this. What you cannot do is stop sending and call the copies somebody else's problem.