CCPA_CPRA_OPT_OUT_001

rules/regulations/us/ccpa_cpra_opt_out.yaml

Citation

Cal. Civ. Code §1798.120(a)(1): A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information. This right may be referred to as the right to opt out of sale or sharing. §1798.120(c): Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer's personal information. §1798.120(d): A business that has received direction from a consumer not to sell or share the consumer's personal information or, in the case of a minor consumer's personal information has not received consent to sell or share the minor consumer's personal information, shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from selling or sharing the consumer's personal information after its receipt of the consumer's direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer's personal information.

Condition

Grants California consumers the right to opt out of the sale or sharing of their personal information. Businesses must honour opt-out requests and provide a clear mechanism. Special protections for minors under 16. Cal. Civ. Code §1798.120 (CCPA as amended by CPRA).

Layer 1 detects

sell, sells, selling, share, shares, shared or sharing, then information or data (optionally preceded by personal), then after, despite or ignoring opt-out; ignore, ignoring or ignored, then opt-out or "do not sell"; no opt-out mechanism, option, link, button or right; fail, failing, failure or failed, then to provide, honour, honor, respect or implement opt-out or "do not sell"; disregard, override or bypass (and words that begin with them), then optionally consumer, consumers or consumer's, then opt-out, then request, preference or direction; a word beginning with continu, then selling or sharing, then information or data (optionally preceded by personal), then after or despite opt-out; and minor or child, then data or information, then sold or shared, then without consent, without authorization, or without parental. Opt-out may be written with a hyphen, a dash, a space or nothing, and the words follow each other with nothing in between. It matches wording, not meaning: it misses the practice told in other words ("Keep the ad-tech pixel firing for the 4,200 California users who clicked Do Not Sell last month, Meta still pays us per match."), it does not read the business thresholds or the exemptions, and it fires on text that only names the practice, such as a refusal. Whether a text does the practice is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved