What steps must a business take if it sells personal information?
The CCPA requires businesses that sell personal information to notify consumers of the sale,1 include a list within their privacy notice of the categories of information that are sold,2 explain that consumers have a “right to opt-out” of the sale,3 and provide a clear and conspicuous link on their homepage titled “Do Not Sell My Personal Information” which takes the consumer to a mechanism that permits them to exercise their opt-out right.4 The regulations implementing the CCPA also require that a business which sells personal information must identify, for each category of information sold, the “categories of third parties” to whom the information was sold.5
