In the US, the default is on.The opt-out has to actually work.
ConsentCenter turns a “Do Not Sell or Share” click or a Global Privacy Control signal into a choice your trackers and systems respect.
- 01 Listen
- 02 Stop
- 03 Respond
Click a provision to read what it says.
An opt-out link that changes nothing is decoration.
Browsers now send the opt-out for people.
Most US state laws are opt-out regimes: processing can start, but consumers must be able to stop the sale or sharing of their data and targeted advertising. California requires businesses to treat a Global Privacy Control signal as a valid opt-out, so a site that ignores it fails people who never touched the banner.
Where this goes wrong first.
GPC signal ignored
The browser sends the opt-out on every request. If the site does not read it, advertising tags fire anyway.
One state’s rules applied to all
States differ on sensitive data, thresholds and response windows. A California-only setup leaves gaps elsewhere.
Opt-out stops at the browser
The website stops sharing. The ad platform audience and the data broker feed are never told.
What changes for you.
Honour “Do Not Sell or Share” and Global Privacy Control signals.
Apply state-specific rules by visitor location.
Run consumer requests to each state’s response window.
How it works
Listen
Read GPC and opt-out clicks, and apply them per state.
Stop
Suppress sale and sharing in tags and downstream systems.
Respond
Verify and fulfil consumer requests within the window.
How the banner should look.
A ConsentCenter banner set up for the US state laws. Click it: accept, reject or open the preferences.
Allowed to run: Strictly Necessary, Functional, Analytics, Marketing
What it is doing
- Processing may run by default; the banner is notice plus an opt-out.
- “Do Not Sell or Share” is one click from the first layer.
- A Global Privacy Control signal is treated as the same opt-out.
- The opt-out link stays available in the footer afterwards.
What the text actually says.
- Cal. Civ. Code § 1798.120
- A consumer has the right to direct a business that sells or shares their personal information to stop doing so.
- Cal. Civ. Code § 1798.135
- Businesses that sell or share personal information must provide a clear “Do Not Sell or Share My Personal Information” link, or honour an opt-out preference signal.
- CCPA Regulations § 7025
- A business must process an opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sale or sharing.
- Cal. Civ. Code § 1798.130
- Businesses must respond to verifiable consumer requests within 45 days, extendable once by a further 45 days when reasonably necessary.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Cookie Consent
Honour GPC and opt-out choices before advertising tags fire.
View productUniversal Consent & Preference Management
Carry the opt-out from the site to the systems that share data.
View productDSAR & Privacy Rights
Handle access, deletion and correction requests to the statutory deadline.
View product
Frequently asked questions
A growing number, including California, Virginia, Colorado, Connecticut, Texas and others, with more taking effect each year. The list changes often, so check current status rather than relying on a page like this one.
Mostly not for ordinary data, but several states require opt-in consent for sensitive data, and for data of known children. Those cases need a consent flow, not just an opt-out.
No product can do that. ConsentCenter is designed to honour opt-outs and run requests; whether and how each state law applies to you is a question for your counsel.
Bring us your US state laws question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.