CCPA and CPRA explained for people who live off ads

Put the opt-out link on the home page

Anyone who sells or shares data needs a clear link in the header or footer of the home page. The rules also accept a single link called Your Privacy Choices or Your California Privacy Choices, with the official icon next to it.

Accept GPC as a valid opt-out

The attorney general says GPC must be respected as a valid opt-out request. The rules in force since 2026 require the site to show the visitor the status of their choice.

Honor the opt-out quickly

The opt-out must be honored as soon as possible, within 15 business days at most. Requests to know, delete or correct have a 45-day deadline, with another 45 if the visitor is notified.

Give notice at collection and keep the full policy

The notice appears before or at the time data is collected and includes the link to the privacy policy. The policy explains the visitor's rights and how to use them.

Offer at least two channels

Anyone who sells or shares data needs two or more ways to opt out. For access or deletion requests, an online-only business may offer just an email.

Keep the choices balanced

The rules require symmetry in the choices. A notice that only offers Yes and Ask me later is not balanced, because there is no way to refuse.

Ask for authorization for under 16

To sell or share data of someone you know is under 16, prior authorization is required. Under 13, the authorization comes from the parents or guardians.

Pass the opt-out to Google

In the California section of the GPP string, an opt-out of sale or sharing turns on RDP. Another option is to turn on RDP in the tag for people who clicked the link.

// GPT: liga o processamento restrito de dados (RDP)
// para quem recusou a venda ou a publicidade direcionada
googletag.cmd.push(function () {
  googletag.pubads().setPrivacySettings({
    restrictDataProcessing: true
  });
});