If your website shares visitor data with ad platforms – and if you run the Meta Pixel or Google Ads remarketing, it does – US state privacy laws require you to give visitors a way out. The centerpiece is the “Do Not Sell or Share My Personal Information” link and the opt-out page behind it. Here’s how to build one that satisfies California’s CCPA\/CPRA and the 19 other state laws now in force, including the parts most sites get wrong.<\/p>\n\n\n\n
Under the CCPA as amended by the CPRA, “selling” means transferring personal information for money or any other valuable consideration<\/em>, and “sharing” covers disclosure for cross-context behavioral advertising even when no money changes hands<\/strong>. That definition captures:<\/p>\n\n\n\n If none of that applies to you – you truly don’t sell or share – you aren’t required to post the link (but your privacy policy must accurately say so). For everyone else, read on.<\/p>\n\n\n\n California’s CCPA covers for-profit businesses doing business in the state that meet any one of: gross revenue above $26,625,000<\/strong> (the current inflation-adjusted threshold), 100,000+ California consumers or households<\/strong>, or 50%+ of revenue from selling\/sharing personal data<\/strong>. Your headquarters location is irrelevant.<\/p>\n\n\n\n Nineteen other states run comparable opt-out rights – Virginia, Colorado, Connecticut, Texas, Oregon, and the January 2026 arrivals Indiana, Kentucky, and Rhode Island among them, with Arkansas effective July 2026. Because most copy the same template, one well-built opt-out page can serve residents of all of them<\/strong>.<\/p>\n\n\n\n New for 2026<\/strong><\/p>\n\n\n\n Since 1 January 2026<\/strong>, California requires businesses to visibly confirm<\/strong> that an opt-out was processed -an “Opt-Out Request Honored” message, badge, or a toggle that reflects the honored state. This applies to GPC signals too: silent back-end processing no longer satisfies the regulation. Your page (and banner) should show the user their current status.<\/p>\n<\/blockquote>\n\n\n\n GPC is a browser-level signal (on by default in Firefox and Brave, available as extensions elsewhere) that transmits a legal opt-out request automatically on every page load. As of 2026, roughly a dozen states mandate honoring it – California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas- meaning:<\/p>\n\n\n\n Well-known implementations to study: T-Mobile’s toggle-based preference page and the webform patterns used by Levi’s and McDonald’s- all footer – linked, form-light, and account-free.<\/p>\n\n\n\n No. One opt-out page serves all states because the underlying right stop selling\/sharing my data, honor my universal opt-out signal is the common template. Just avoid California-only wording if you honor requests from all US visitors (recommended: honor everyone, verify no one).<\/p> <\/div> You may geo-target it, but most businesses show it to all US visitors it’s simpler, safer as more states come online, and consumers increasingly expect it.<\/p> <\/div> Cookie-based sharing should stop effectively immediately via your CMP. Back-end requests (e.g., stopping list sales) must be completed within 15 business days in California, and you must instruct downstream recipients accordingly.<\/p> <\/div> No – they’ll see non-personalized ads. Opting out stops the sale\/sharing of their data for cross-context behavioral advertising, not advertising itself. Say this on the page; it reduces support tickets.<\/p> <\/div> <\/div>\n\n\n\n Ship a compliant opt-out flow today<\/strong><\/p>\n\n\n\n CookieLet’s opt-out banner handles the link, the preference page, instant script suppression, GPP signals, GPC recognition, and the 2026 confirmation requirement – across all 20 state laws.<\/p>\n\n\n\n\n
Who Must Comply in 2026<\/h2>\n\n\n\n
The Link: Wording and Placement Rules<\/h2>\n\n\n\n
\n
What the Opt-Out Page Itself Must Contain<\/h2>\n\n\n\n
\n
\n
Global Privacy Control: The Opt-Out You Receive Without a Click<\/h2>\n\n\n\n
\n
Reference Build: a Compliant Opt-Out Page in Five Blocks<\/h2>\n\n\n\n
\n
Common Mistakes That Trigger Enforcement<\/h2>\n\n\n\n
\n
Frequently Asked Questions<\/h2>\n\n\n\n
\n