Following Data Privacy Day, Attorney General Bonta Reminds Consumers of Their Right to Opt-Out of the Sale of Their Personal Information

 Global Privacy Control signal sends ‘do not sell’ requests on your behalf  

OAKLAND — California Attorney General Rob Bonta today reminded Californians of their right to stop or "opt-out" of the sale and sharing of their personal information under the California Consumer Protection Act (CCPA), California’s landmark, first-in-nation privacy law. Along with the attorneys general of Colorado and Connecticut, states that also have robust privacy protections, Attorney General Bonta encourages consumers to consider familiarizing themselves with the Global Privacy Control (GPC), an easy-to-use browser setting or extension that automatically signals to businesses that they should not sell your personal information to third parties, including for targeted advertising. 

“Every single one of our online interactions is a robust source of data that broadcasts who we are, what we like, and how we live. Many websites install tracking software that allows third parties to track consumers, use the information they learn to create entire profiles of users, and deploy targeted ads that follow us around our time surfing the web,” said California Attorney General Rob Bonta. “Today, I remind Californians of their right to opt-out and take back control of their personal data. Global Privacy Control is the easiest way to limit the number of third parties that have access to our personal information and online behavioral data. I also encourage mobile device manufacturers to develop an easy, GPC-like feature that consumers can use to signal the right to opt-out.”

“Websites are constantly tracking and collecting our personal information for every purpose you can imagine. In Connecticut, you can now opt out of tracking across all sites by selecting a single simple option. It’s an easy step to take back control over your data and protect your privacy,” said Connecticut Attorney General William Tong.   

Data comes from nearly everywhere online, even when people think they’re not revealing anything. It has been estimated that the average person produces 1.7 MB of data per second or 6,120 MB of data per hour. 

Websites can track and amass personal information and behavioral data like pages visited, time spent on pages, clicks, and detailed purchase information to create and share profiles and inferences about consumers. Apps and other software can collect and transmit personal information as well, including sensitive personal information like a user’s precise geolocation. Preventing third parties from receiving this information is a key step to protecting private information and stopping the proliferation of your data in the online ecosystem. 

YOUR RIGHT TO OPT OUT

The CCPA vests California consumers with control over the personal information that businesses collect about them, including the right to request that businesses stop selling or sharing your personal information. With some exceptions, businesses cannot sell or share your personal information after they receive your opt-out request unless you later provide authorization allowing them to do so again. Businesses must wait at least 12 months before asking you to opt back in to the sale or sharing of your personal information.  

HOW DO I OPT OUT?

Consumers have two options to opt out of the sale of their data: 

OPTION 1: Enabling Global Privacy Control 

The GPC is a signal that allows users to automatically indicate to the websites they visit that they would like to opt-out of the “sale” of their personal information. The GPC signal is an easy way to opt-out because a consumer does not have to make individualized requests to opt-out on each website they visit. GPC can be downloaded via a browser extension; some browsers offer a GPC setting. Installing GPC is simple and ensures your personal is protected. 

Click here for a video to show you how to install GPC.

OPTION 2: Opt-Out One Business at a Time 

Businesses that sell personal information must provide a clear and conspicuous “Do Not Sell or Share My Personal Information” link on their website that allows you to submit an opt-out request. Businesses cannot require you to create an account to submit your request or ask for additional information to process your opt-out. 

If you can’t find a business’s “Do Not Sell or Share My Personal Information” link, review its privacy policy to see if it sells or shares personal information. If the business does, it must also include that link in its privacy policy. If a business’s "Do Not Sell My Personal Information" link is not working or difficult to find, you may report the business to our office by visiting oag.ca.gov/report.

For more information on the CCPA and opting out, please see here. For a tutorial on installing GPC, please see here.