Request letter templates
CCPA Do Not Sell or Share request template for California
Quick answer
Use the company's Do Not Sell or Share My Personal Information link if it has one; if not, copy the letter below and send it through a method in its privacy policy. You don't have to prove who you are or create an account to opt out, and the business must stop selling or sharing your data within 15 business days. Turning on Global Privacy Control in your browser counts as an opt-out request at covered sites you visit.
All privacy laws“A business shall not require a verifiable consumer request for a request to opt-out of sale/sharing.”
- Applies in
- California, United States
- Companies must answer within
- As soon as feasibly possible, and no later than 15 business days from receipt (11 CCR § 7026(f)(1)). The business must then wait at least 12 months before asking you to opt back in (11 CCR § 7026(k)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: privacy.ca.gov, oag.ca.gov, cppa.ca.gov
Last verified against the official page:
California residents, and for-profit businesses covered by the CCPA that sell your personal information or share it for cross-context behavioral advertising (ads based on your activity across other sites and apps).
Your rights
-
Right to opt out of sale or sharing
Tell a business at any time to stop selling your personal information or sharing it for cross-context behavioral advertising (Civ. Code § 1798.120).
-
No verification, no account
The business can't require a verifiable request or make you create an account. It may only ask for what it needs to identify whose data to stop selling (11 CCR § 7026(c)-(d)).
-
One opt-out for everything
The business can offer partial choices, but it must also offer a single option to opt out of all sale and sharing (11 CCR § 7026(h)).
-
Proof it worked
The business must give you a way to confirm your opt-out was processed, such as an Opt-Out Request Honored message or a setting in your account (11 CCR § 7026(g)).
General information, not legal advice.
How to use it
- 1
Look for the Do Not Sell or Share link
Businesses that sell or share personal information must show a Do Not Sell or Share My Personal Information link (or an alternative opt-out link), and it must take you straight to the opt-out, without scrolling through a privacy policy (11 CCR § 7004(a)(5)(A)). If you can't find it, check the privacy policy.
- 2
Or send the letter through another listed method
Businesses must offer at least two ways to opt out. Others can include a toll-free number, email, or a form by mail or in person. Paste or send the letter below and keep a copy with the date.
- 3
Turn on Global Privacy Control
Global Privacy Control (GPC) is an opt-out signal your browser sends to the sites you visit. It's built into some browsers and available as an extension in others, and covered businesses must treat it as a valid request to stop selling or sharing your data. The Attorney General's GPC page explains it.
- 4
Check it was processed
The business has 15 business days. After that, look for the confirmation it has to provide, for example an Opt-Out Request Honored message on its site or a setting in your account.
- 5
Report broken or hidden opt-outs
If the link or method doesn't work or is hard to find, report the business to the Attorney General or file a complaint with CalPrivacy.
No answer in time? Complain to California Privacy Protection Agency (CalPrivacy) and the California Attorney General .
The letter
Fill in the parts in [brackets] before you send it.
Subject: Do Not Sell or Share My Personal Information (CCPA opt-out request) [Your full name] [The email address or phone number the business knows you by] [Date] To: [Business name], privacy team [The opt-out method from the privacy policy: web form, email address or mailing address] Dear [Business name] privacy team, I am a California resident. Under the California Consumer Privacy Act (Civil Code section 1798.120), I direct you not to sell or share my personal information. This covers all sale and all sharing, including sharing for cross-context behavioral advertising. [Optional, delete if you don't want it: Under Civil Code section 1798.121, I also ask you to limit the use and disclosure of my sensitive personal information.] You can identify my records with these details: - Name: [your name] - Email address and phone number: [list] - Account or customer number: [number, if any] This is a request to opt out of sale and sharing, so please don't ask me to verify my identity or create an account. Please: 1. stop selling and sharing my personal information as soon as feasibly possible, and no later than 15 business days after you receive this request; 2. notify any third parties to whom you sell or share my personal information between receiving this request and complying with it, direct them to comply with my request, and ask them to forward it to anyone they have passed my information on to in that time; 3. tell me how I can confirm that my opt-out has been processed. [If an authorized agent is sending this: This request is sent on my behalf by [agent name], my authorized agent. My signed permission is attached.] Sincerely, [Your name]
Opting out isn't deleting
An opt-out stops a business selling your data or sharing it for targeted ads. The data stays where it is. If you want it gone, send a CCPA request to delete as well, and for data brokers use California's free DROP tool, which sends one deletion request to every registered broker. Our CCPA page covers the rest of your rights.
The upside of opting out is speed. There's no identity check, so a business can't hold it up over verification.
Why the letter asks for so little
The regulations limit what a business can ask for: only what it needs to know whose data to stop selling. So give your name and the email address or phone number the business would know you by, and nothing more. If it asks for an ID upload, it's asking for more than an opt-out needs.
The line about third parties covers data the business passes on between your request and the day it complies. It has to tell those recipients about your opt-out and ask them to pass it on too.
The sensitive data line is optional. It uses a separate right, under Civil Code § 1798.121, to limit how a business uses sensitive personal information.
Where Serus fits
An opt-out works company by company, and Global Privacy Control only reaches the sites you visit with it on. Data brokers that already hold your details need a removal request. Serus finds the data brokers and people-search sites that list you where you live, sends the removal requests, follows up and checks for relistings. Run a free scan to see where you're listed.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Do I need to prove who I am to opt out?
No. A business shouldn't require identity verification. It may ask for information it needs to stop selling the right person's data, and can only use it for that.
Can a business refuse my opt-out?
Only in limited cases, such as legal obligations or legal claims, data that's exempt from the CCPA, or a documented good-faith belief that the request is fraudulent, which it must explain to you.
Is rejecting cookies the same as opting out?
No. A cookie banner or cookie controls on their own aren't an acceptable way to opt out, because cookies are about collection, not sale or sharing.
Does opting out delete my data?
No. It stops sale and sharing. To remove data, send a separate request to delete, or use DROP for data brokers.
Sources
- privacy.ca.gov/wp-content/uploads/sites/357/2026/03/ccpa_regulations_eff_20260101-1.pdf
- oag.ca.gov/privacy/ccpa
- oag.ca.gov/privacy/ccpa/gpc
- oag.ca.gov/contact/consumer-complaint-against-business-or-company
- cppa.ca.gov/webapplications/complaint
- privacy.ca.gov/submit-a-complaint/ccpa-complaints/
- privacy.ca.gov/drop/
Something wrong or out of date? Tell us and we'll re-check it.