How to Submit a Do Not Sell My Personal Information Request

To submit a Do Not Sell My Personal Information request, find the link labeled “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” in the footer of the business’s website or inside its privacy policy, click through, and complete the short form or toggle it presents.¹ The business has 15 business days to stop selling your data once it receives the request.² You don’t need a lawyer, a form letter, or a reason.

How to Send the Request

Businesses covered by state privacy laws are required to post the opt-out link in a clear, conspicuous location, usually the website footer.¹ Some route you to a dedicated web form, others to a privacy dashboard that also handles data-deletion and data-access requests.

Expect the business to ask for basic details so it can match the request to its records: your name, your email, sometimes an account number. It cannot force you to create an account just to opt out, and the identity check for an opt-out is looser than for a deletion or access request.¹

After you submit, watch for a confirmation email or on-screen acknowledgment. If nothing arrives, follow up. A missing confirmation is often the first sign that the request has not been logged. Save the date, take a screenshot of the form you submitted, and keep the confirmation. If the business later ignores your request and you need to file a complaint, that paper trail is what makes the complaint credible.

Opting Out Everywhere at Once With Global Privacy Control

Sending a separate request to every website you use is impractical. Global Privacy Control (GPC) sends an automatic opt-out signal from your browser to every site you load, and several state privacy laws require businesses to treat that signal exactly the same as a manual opt-out.³

How to turn it on depends on your browser:

Brave and DuckDuckGo have GPC enabled by default.
Firefox users can switch it on inside privacy settings.
For Chrome, Edge, and Safari, install an extension that sends the signal, such as Privacy Badger from the Electronic Frontier Foundation, Disconnect, or OptMeowt.

GPC only covers websites you visit through the browser where it’s enabled. It won’t reach mobile apps, offline data brokers, or accounts you interact with by phone or in person. For those, individual requests are still the way.

The California Data Broker Shortcut

If you live in California, one request can now reach more than 500 registered data brokers at the same time. The state launched the Delete Request and Opt-Out Platform (DROP) in January 2026.⁴ You verify your identity, build a short profile, and submit. Starting August 1, 2026, registered data brokers must process the request and delete your information within 90 days. The tool is limited to California residents and to brokers registered with the state, but it’s the fastest way to reach companies you’d never think to contact one by one.

What “Selling” Covers

The word “sale” in these laws is much broader than a cash transaction. A sale happens any time a business transfers, discloses, or makes your personal information available to another company for monetary or other valuable consideration.⁵ The “other valuable consideration” phrase is what does the work. When a retailer lets an ad network drop tracking cookies on your browser, no money changes hands, but the retailer gets free analytics and the ad network gets your browsing behavior. That trade counts.⁶

The same logic applies to a business handing purchase histories to a data broker, a mobile app pushing your location to a marketing firm, or a social platform letting advertisers build profiles from your activity. The personal information covered is equally wide: your name, email, IP address, purchase history, browsing and search activity, geolocation, and inferences a company draws by combining those points.

What the Business Has to Do Once You Request It

The business must stop selling your personal information as soon as feasible, and in no case later than 15 business days from the date it received your request.² If it already sold your data to third parties during that processing window, it must notify those parties and tell them to stop selling it too.

In practice, opting out should mean fewer eerily specific ads following you around the internet. The business can still use the data it already collected for its own internal purposes, such as processing your orders or improving its products. What it can no longer do is hand that data to third parties for their benefit.

Once you’ve opted out, the business must wait at least 12 months before asking you to reconsider.⁷ You can opt back in on your own at any time, but the company cannot pester you about it. It must also keep records of your request and its response for at least 24 months.⁸

A business cannot retaliate against you for opting out. It cannot deny you goods or services, charge you a higher price, or give you a lower quality of service because you refused to let it sell your data. It also cannot hint that opting out will get you a worse deal.

When Your Data Can Still Move

Opting out doesn’t seal your information off completely. Privacy laws recognize several situations where data can keep flowing:

Transfers to service providers under contract, such as a payment processor handling your credit card, a cloud host storing order records, or a shipping company fulfilling your purchase. These are not “sales” as long as the service provider is contractually barred from using or reselling your data for its own purposes.⁵
Mergers, acquisitions, and bankruptcy sales, where your data transfers to the new owner. The new owner has to keep honoring the privacy choices you already made.
Transfers you asked for, like connecting your bank to a budgeting app. You directed the disclosure, so it isn’t a sale.
Information already in the public record, such as property records or court filings.
Data that has been de-identified or aggregated so it cannot reasonably be linked back to you.

The service-provider category is where businesses most often try to sidestep an opt-out. The label only sticks if the receiving company is contractually restricted to using your data for the specific service it was hired to perform. If the contract is loose or the partner uses the data for its own marketing, the exception doesn’t apply.

Who Actually Has This Right

As of 2026, roughly 19 states have comprehensive consumer data privacy laws, and most include some form of opt-out right covering data sales, targeted advertising, or both. California’s CCPA is the broadest, and Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and more than a dozen others have their own versions with slightly different rules.

If your state has no comprehensive privacy law, the “Do Not Sell” link still works when you click it, but a business in an unregulated state has no legal duty to honor it. Some companies apply one privacy standard nationwide because managing state-by-state compliance is more trouble than it’s worth, so a request is still worth sending.

If You’re Requesting on Behalf of Someone Under 16

The rules invert for minors. A business that knows a consumer is under 16 must get affirmative permission — an opt-in — before selling or sharing that person’s data at all.² For children under 13, that consent has to come from a parent or guardian. Teenagers between 13 and 15 can consent themselves.⁹ A company that willfully ignores a consumer’s age is treated as if it had actual knowledge, so pleading ignorance is not a defense. If you find that a company sold your child’s data without consent, that’s worth reporting to your state attorney general.

If the Business Ignores You

If a business doesn’t respond, keeps selling your data, or makes the opt-out process unreasonably hard, your enforcement path runs through your state attorney general. Most state privacy laws don’t let individual consumers sue over an ignored opt-out request; enforcement is reserved for state agencies.⁷ The narrow exception is data breaches, where some states allow private lawsuits if unencrypted personal information was stolen because the business failed to maintain reasonable security.

Filing a complaint is straightforward. Most attorney general offices accept complaints online. You describe what happened, identify the business, and attach documentation: screenshots of a broken link, a copy of your original request, the confirmation email or a note that one never arrived. The office may mediate with the business, investigate a pattern of non-compliance, or bring enforcement action.¹⁰ Penalties are assessed per violation, meaning per consumer, per incident, and adjusted for inflation each year.¹¹

1
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) – Section: B. RIGHT TO OPT-OUT OF SALE OR SHARING
2
California Legislative Information. California Civil Code 1798.120 – Consumers Right to Opt Out of Sale or Sharing of Personal Information
3
Global Privacy Control. Global Privacy Control – Take Control Of Your Privacy
4
privacy.ca.gov. Delete Request and Opt-Out Platform (DROP)
5
California Legislative Information. California Civil Code CIV 1798.140
6
IAPP. Navigating Disclosures and Sales of Personal Information Under the CCPA
7
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
8
Legal Information Institute. Cal Code Regs Tit 11 7101 – Record-Keeping
9
California Department of Justice – Office of the Attorney General. Protecting Your Childs Privacy Online
10
National Association of Attorneys General. Consumer Protection 101
11
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA