Display a 'Do Not Sell or Share My Personal Information' link on every page that is accessible to California visitors, linking to your opt-out preference center or a dedicated landing page.
When the user opts out, record their preference in a first-party persistent cookie (e.g., ccpa_optout=true with a 12-month max-age) and in your server-side user-preference store keyed to any available identifier.
Before firing any pixel, tag, or SDK call that would share data with third parties for cross-context behavioral advertising, gate execution on the absence of the opt-out flag: if (!getCookie('ccpa_optout')) { firePixel(); }.
Suppress server-side data-sharing API calls (e.g., data clean-room uploads, third-party enrichment calls) in your backend for users with the opt-out preference set.
Honor opt-out requests within 15 business days per CCPA/CPRA regulations; document the fulfillment timestamp and channel (cookie, account record, or both) in your DSAR audit log.
For authenticated users, sync the opt-out preference to their account record so it persists across devices and is not lost when cookies are cleared; provide an authenticated self-service UI to view and withdraw the opt-out.
Known gotchas
CPRA expanded the opt-out right to cover 'sharing' for cross-context behavioral advertising, not just 'sale' for money; many legacy implementations only suppress paid data-sale flows and miss advertising-data sharing.
Re-engaging an opted-out user in data sale/sharing requires explicit re-authorization from the user; a pre-checked consent checkbox or a new account creation does not constitute re-authorization under CCPA.
The CPRA 'Limit the Use of Sensitive Personal Information' right is separate from the Do Not Sell/Share right and has its own 15-business-day fulfillment requirement and separate link requirement on your homepage.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp