Purpose of the Template
You need a straightforward way to present CCPA opt-out rights directly in your data collection forms. This script template provides ready-to-use language for embedding opt-out notices and links at the point of collection, whether it's a newsletter signup, account creation form, or lead-capture widget.
The California Consumer Privacy Act requires you to inform consumers of their right to opt out of the sale of personal information at or before the point you collect it. This template meets that requirement while maintaining user-friendly language. It's designed for teams that need to deploy CCPA-compliant forms quickly without waiting for legal review of every variation.
Prerequisites
Before implementing this template, ensure:
You sell personal information under the CCPA definition. The statute defines "sale" broadly. Sharing email addresses with advertising partners or passing user identifiers to analytics platforms often qualifies. If you're unsure, audit your third-party data flows first.
You have a functional Do Not Sell mechanism. This template links to your opt-out page or preference center. That destination must allow consumers to submit an opt-out request without creating an account or verifying their identity beyond what's reasonably necessary.
Your privacy policy discloses categories of personal information sold. The CCPA requires you to list what you sell and to whom. Your webform notice supplements that policy; it doesn't replace it.
You can honor opt-outs promptly. The statute doesn't specify an exact window, but California Attorney General guidance suggests 15 business days as a practical maximum. Ensure your CRM or data platform can suppress opted-out records across all downstream systems.
The Template
Copy the version that matches your collection scenario. Customize the bracketed fields, then embed the notice directly above or below your form's submit button.
Basic Inline Notice (Newsletter Signups, Contact Forms)
By submitting this form, you agree to receive [emails/communications]
from [Your Company Name]. We may share your information with service
providers and advertising partners. You have the right to opt out of
the sale of your personal information. To exercise this right, visit
[link: Do Not Sell My Personal Information] or email us at
[[email protected]].
Checkbox-Based Consent with Opt-Out Disclosure
☐ I agree to receive marketing emails from [Your Company Name].
We share email addresses and browsing data with advertising partners
to personalize content. Under California law, you may opt out of this
data sharing. Learn more in our [Privacy Policy] or submit an opt-out
request at [Do Not Sell My Personal Information].
Account Creation with Persistent Opt-Out Link
By creating an account, you acknowledge that [Your Company Name] may
share your profile data, purchase history, and device identifiers with
third-party analytics and advertising platforms. California residents:
You can opt out of this data sale at any time through your Account
Settings > Privacy Controls, or by visiting [Do Not Sell Link].
Lead-Capture Form with Granular Disclosure
We collect your name, email, company, and job title. This information
may be shared with:
• Marketing automation platforms (e.g., [Platform Name])
• CRM providers (e.g., [CRM Name])
• Advertising networks for retargeting
California residents have the right to opt out of these data sales.
Submit your opt-out request here: [Do Not Sell My Personal Information]
Customization Instructions
Replace bracketed placeholders with your specifics. Don't leave "[Your Company Name]" in production. Use your actual legal entity name as it appears in your privacy policy.
Match the verb tense to your data practices. If you share data in real time, write "we share." If there's a delay, write "we may share" or "we will share." Precision matters when regulators review your disclosures.
Link to a dedicated opt-out page, not your general privacy policy. The CCPA requires a "clear and conspicuous" link titled "Do Not Sell My Personal Information" or "Do Not Sell or Share My Personal Information." Your homepage footer must include this link, and your webforms should point to the same destination.
Adjust disclosure granularity based on context. A simple newsletter signup can use the basic inline notice. A B2B lead form that feeds Salesforce, HubSpot, and three ad platforms should list those categories explicitly. The more data you collect and share, the more specific your notice should be.
Don't bury the opt-out link in a wall of text. If your form notice exceeds three sentences, break it into bullet points or use bold text to highlight the opt-out mechanism. Consumers must be able to find and understand their rights without decoding legalese.
Consider adding a pre-checked opt-out checkbox for California visitors. Some teams use geolocation to display "☑ I am a California resident and wish to opt out of data sales" as a default-selected option. This approach is conservative but defensible. Just make sure the checkbox actually triggers an opt-out flag in your system.
Validation Steps
Deploy your script, then verify compliance with these checks:
Test the opt-out link from each form. Click through to confirm it reaches your Do Not Sell page, not a 404 or your homepage. Use an incognito window to simulate a first-time visitor's experience.
Submit a test form and confirm the opt-out flag propagates. If you've added a checkbox or automatic opt-out for California residents, submit a test entry and check whether that record appears in your CRM with the correct suppression tag. Then verify that the record doesn't sync to advertising platforms.
Review your form analytics for drop-off. If conversion rates plummet after adding the CCPA notice, your language may be too aggressive or your opt-out mechanism too prominent. Adjust phrasing to be informative without alarming, but never hide the disclosure to recover conversions.
Audit third-party form builders for override behavior. If you use Typeform, Gravity Forms, or similar tools, confirm that your embedded script doesn't get stripped out during form rendering. Some platforms sanitize HTML and remove custom disclosure text.
Document your implementation date. When the California Attorney General or a plaintiff's attorney asks when you began providing opt-out notices at collection, you need a clear answer. Screenshot your forms, save the deployment ticket, and note the date in your compliance log.
Schedule a quarterly review. Your data-sharing relationships will change. When you add a new analytics vendor or advertising partner, update your webform disclosures to reflect that relationship. Stale notices create liability.
The CCPA, signed into law after the California legislature adjourned on September 13, 2019, gives you a stable compliance target. Use this template to align your policy promises with point-of-collection practices.
