When you click a link labeled “Do Not Sell or Share My Personal Information” on a company’s website, you are exercising a legal right, available in roughly 20 states as of 2026, to stop that business from handing your personal data to other companies for money, for advertising, or for anything else of value. Many national companies apply the right to every U.S. user because running one system is cheaper than running fifty. The request usually takes a few clicks, and a single browser setting can send it to every site you visit automatically.
What You Are Actually Turning Off
Privacy laws separate two data flows. Selling means any transfer of your personal information to a third party in exchange for money or other value. Sharing is narrower and targets cross-context behavioral advertising: passing your data to another company so it can track you across sites and serve ads based on your combined activity. That is why an ad for a product appears minutes after you looked at it somewhere else. Opting out blocks both pipelines.
The data covered is broader than most people expect. It includes your name, email, and phone number, and also your browsing history, purchases, geolocation, device identifiers, and inferences a company has drawn about you. If a business can link a piece of data back to you or your household, it is generally covered.
Finding and Using the Opt-Out Link
Regulated businesses are required to post a clear link labeled “Do Not Sell or Share My Personal Information” or “Your Privacy Choices,” usually in the footer of the homepage next to the privacy policy and terms of service. Some companies use a small toggle-style icon beside the words “Your Privacy Choices” rather than spelling the full phrase out.
Clicking the link opens a short form or a preference center. You enter identifying information the company needs to find your record, typically your email, phone number, or account ID. Some sites skip the form and present toggles for individual data uses, such as “sale of personal information” and “cross-context behavioral advertising.” Switch them off and submit.
Some companies add a verification step, usually a confirmation link sent to your email, to prevent fraudulent requests filed on your behalf. Check spam if it does not arrive. You should not have to create an account or pay anything to opt out. Multiple state laws specifically prohibit those barriers.
Global Privacy Control: One Setting for Every Site
Filling out forms site by site gets old fast, and most people give up after a few. Global Privacy Control solves this by letting your browser broadcast the opt-out to every website you visit.1W3C. Global Privacy Control (GPC) Legal and Implementation Considerations Guide Under the laws of multiple states, businesses that detect the signal must treat it as a legally valid opt-out request.2State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
Several browsers already support GPC. Brave and DuckDuckGo turn it on by default, and Firefox includes it as a setting you can enable.3Global Privacy Control. Global Privacy Control — Take Control of Your Privacy For Chrome and browsers without built-in support, extensions can add it. Once it is on, every site you visit receives your preference without any further action.
What Happens After You Submit
Most sites show a confirmation screen with a reference number after you submit, and many follow up by email. Save both. They matter if you later need to prove when you filed.
Businesses generally must comply within 15 business days, though the exact deadline varies by state. If the company already passed your data to third parties before processing your request, it typically must notify them to stop using your information as well. After complying, the business must wait at least 12 months before asking you to re-authorize selling or sharing. No pop-ups nagging you to change your mind for a full year.
Sensitive Data and the Right to Limit Its Use
Certain categories get stronger protection: Social Security numbers, financial account credentials, precise geolocation, biometric data, genetic and neural data, health information, information about your sex life or sexual orientation, and data revealing racial or ethnic origin, religious beliefs, or union membership.
For this data, you can generally direct a business to limit its use to what is necessary to provide the service you asked for. A health app may need your medical data to work but has no legitimate reason to feed it into an advertising profile. The right to limit sensitive data is separate from the opt-out of selling and sharing. Use both if you want the broadest protection.
Deleting Data the Company Already Has
Opting out stops future selling and sharing. It does not erase what a business already collected. Most state privacy laws also give you a separate right to request deletion. The process looks similar: submit through the privacy portal, verify your identity, and the business must delete within a set timeframe.
A business can decline in limited circumstances, such as when it needs the data to complete a transaction you initiated, comply with a legal obligation, detect fraud, or fulfill certain internal purposes. If it denies your request, it must explain why in enough detail for you to evaluate the reason. Vague refusals do not meet the legal standard. When the business does delete, it must also direct its service providers and other recipients to delete the data unless doing so would be genuinely impractical, and it must explain why if it claims that exception.
Loyalty Programs and Whether Opting Out Costs You Anything
Most state privacy laws include nondiscrimination provisions. A business generally cannot deny services, charge higher prices, or reduce quality because you opted out.
The narrow exception is a financial incentive program where the discount is directly tied to the value of the data you provide. A grocery loyalty program that gives coupons in exchange for purchase history could discontinue those specific benefits if you opt out, but only if the coupon value is reasonably related to the value of your data to the business. The company cannot use that as cover to cut off unrelated services or raise your prices. If a business wants to offer a deal in exchange for your data, it must explain the terms upfront and get your opt-in consent, which you can revoke at any time.
Dark Patterns and What to Do If Your Request Is Ignored
Some businesses technically offer an opt-out but design the process to discourage you from finishing it. Over a dozen states now prohibit these deceptive design practices in privacy choices, and the Federal Trade Commission treats them as unfair or deceptive under federal law.
Common tactics: an “Accept All” button that is large and brightly colored while “Reject All” hides under multiple menus in gray text, pre-selected consent checkboxes, confusing double negatives like “uncheck this box to not opt out,” a decline button labeled “Not Now” instead of “No,” and an unreasonable number of screens to complete what should be a single click. If opting out is significantly harder than opting in, that itself is a regulatory red flag.
If you have submitted a valid request and the business has not complied, document everything: screenshots, confirmation emails, dates, and any follow-up. Then escalate. Your state attorney general is typically the primary enforcement agency for consumer privacy complaints, and many states have online complaint portals. Some states have dedicated privacy protection agencies with their own enforcement authority. At the federal level, you can file with the Federal Trade Commission, which tracks patterns across companies even when it does not act on individual complaints. Complaint volume drives investigation priorities, so your filing contributes to enforcement pressure whether or not you hear back directly.
If the User Is a Minor
The rules flip for children and teenagers. For children under 13, a business generally cannot sell or share personal information without a parent or guardian’s affirmative consent. For teenagers 13 to 15, the teenager’s own opt-in consent is required. Minors are opted out by default rather than having to opt out themselves. A business that willfully ignores a user’s age is generally treated as if it knew, which closes the loophole of deliberately not asking.