Implement a CCPA/CPRA 'Do Not Sell or Share' opt-out pixel suppression flow using a CMP API

Steps

1. Display a 'Do Not Sell or Share My Personal Information' link on every page that is accessible to California visitors, linking to your opt-out preference center or a dedicated landing page.
2. When the user opts out, record their preference in a first-party persistent cookie (e.g., ccpa_optout=true with a 12-month max-age) and in your server-side user-preference store keyed to any available identifier.
3. Before firing any pixel, tag, or SDK call that would share data with third parties for cross-context behavioral advertising, gate execution on the absence of the opt-out flag: if (!getCookie('ccpa_optout')) { firePixel(); }.
4. Suppress server-side data-sharing API calls (e.g., data clean-room uploads, third-party enrichment calls) in your backend for users with the opt-out preference set.
5. Honor opt-out requests within 15 business days per CCPA/CPRA regulations; document the fulfillment timestamp and channel (cookie, account record, or both) in your DSAR audit log.
6. For authenticated users, sync the opt-out preference to their account record so it persists across devices and is not lost when cookies are cleared; provide an authenticated self-service UI to view and withdraw the opt-out.