The Challenge
In late 2022, a privacy team at a mid-sized retailer faced a dilemma during their CCPA compliance review: should they post a "Do Not Sell My Personal Information" link when their privacy notice clearly stated they didn't sell personal information?
The legal requirement was clear. Cal. Civ. Code § 1798.135(a)(1) mandates the link only for businesses that sell personal information. Cal. Code Regs. tit. 11, § 999.306(d)(1) exempts businesses that affirmatively state they don't sell data. The team's first instinct was to skip it. Why create consumer confusion and invite unnecessary operational burden?
But they noticed something odd. Competitors with identical "we don't sell" disclosures had posted the link anyway. A survey by Greenberg Traurig LLP of 555 companies found that about 8% of those claiming not to sell personal information had voluntarily implemented the opt-out mechanism.
That 8% wasn't making a mistake. They were buying insurance.
The Environment and Constraints
The team operated under three competing pressures.
First, business development was exploring partnerships with data brokers and ad-tech vendors. Nothing was imminent, but the roadmap included potential revenue streams that might cross CCPA's "sale" threshold. The legal definition is broad: any disclosure of personal information to a third party for monetary or other valuable consideration qualifies, even if money doesn't change hands directly.
Second, Cal. Civ. Code § 1798.120(b) contains a trap. If you start selling personal information after collection, you can only do so for consumers who were given the opportunity to opt out at the time of collection. No retroactive consent. If you didn't offer the mechanism upfront, you can't use that data in sales later, effectively locking you out of future business models.
Third, consumer trust was fragile. The privacy notice already contained the standard "we don't sell" language, but marketing research showed consumers were skeptical. They'd been trained by years of dark patterns to distrust privacy claims. A visible opt-out link, even when not required, signaled transparency in a way legal prose couldn't.
The Approach Taken
The team implemented the voluntary "Do Not Sell My Personal Information" link with three design principles.
They built the opt-out mechanism to CCPA's full specification, not a placeholder. The link appeared in the footer, used the exact statutory language, and connected to a functional preference center. When a consumer clicked through, they could submit their opt-out request immediately, no account creation, no email verification loop, no dark patterns suggesting they reconsider.
They documented the decision in writing. The privacy committee memo explained that the link preserved future business flexibility under Cal. Civ. Code § 1798.120(b) while demonstrating good-faith transparency. If the business model evolved to include data sales, they'd already established the opt-out mechanism at the time of collection. They recorded that the opt-out preference would be honored even though no current processing qualified as a "sale."
They trained customer support. The link generated questions, "I thought you said you don't sell my data?" The support team learned to explain: "We don't currently sell your information, and this link lets you ensure we never will, even if our business changes." That framing turned potential confusion into a trust signal.
Results and Metrics
The immediate operational impact was minimal. Opt-out requests came in at roughly the same volume as CCPA deletion requests, manageable through existing workflows. The preference center logged each submission, creating an auditable record that the business had offered the mechanism at collection time.
The strategic benefit materialized eight months later. Business development finalized a partnership with an advertising platform that would have triggered CCPA's sale provisions. Because the opt-out link had been live since the previous year, the legal team could proceed without re-collecting consent or excluding existing customer data. The 8% of consumers who'd submitted opt-out requests were automatically filtered from the data feed. Everyone else remained eligible under the original collection notice.
The trust signal proved harder to quantify but showed up in qualitative research. When consumers were asked why they trusted the company's privacy practices, several mentioned the visible opt-out link as evidence of "actually caring, not just checking boxes." The link cost almost nothing to maintain but carried disproportionate symbolic weight.
What They Would Do Differently
The team identified two refinements for future implementations.
First, they'd invest more in the preference center's language. The initial version used legalistic phrasing that confused consumers about what "sale" meant under CCPA. A revised version explained in plain terms: "We're giving you control over whether we share your information with partners for their own marketing purposes, even though we don't currently do that." Clearer framing reduced support tickets by roughly a third.
Second, they'd coordinate the opt-out mechanism with other privacy rights from the start. The CCPA preference center initially handled only "Do Not Sell" requests, requiring consumers to submit separate requests for deletion or access. Consolidating all rights into a unified portal would have reduced consumer friction and simplified backend workflows.
Takeaways for Your Team
If your privacy notice claims you don't sell personal information, you're not required to post the opt-out link. But you should consider it anyway if your business model might evolve.
The 8% of companies offering voluntary opt-out mechanisms aren't being overly cautious, they're preserving strategic flexibility. Cal. Civ. Code § 1798.120(b) creates a one-way door: once you collect data without offering the opt-out, you can't use that data in sales later. The voluntary link keeps that door open.
Don't treat the voluntary link as a placeholder. If you post it, honor it. Build a real opt-out mechanism that works today, even if you're not selling data yet. Anything less creates consumer distrust and potential regulatory exposure if you do start selling.
Document your reasoning. When you implement a voluntary privacy control, write down why. That memo becomes evidence of good-faith compliance if regulators or consumers question your practices later. It also helps future privacy teams understand the business context behind technical decisions.
The voluntary "Do Not Sell" link is cheap insurance against business model uncertainty. It costs almost nothing to implement and maintain, but it protects revenue options you might need when market conditions shift. In privacy compliance, the flexibility to adapt is often more valuable than the cost of maintaining unused infrastructure.
