Request letter templates

CCPA Do Not Sell or Share request template for California

Quick answer

Use the company's Do Not Sell or Share My Personal Information link if it has one; if not, copy the letter below and send it through a method in its privacy policy. You don't have to prove who you are or create an account to opt out, and the business must stop selling or sharing your data within 15 business days. Turning on Global Privacy Control in your browser counts as an opt-out request at covered sites you visit.

“A business shall not require a verifiable consumer request for a request to opt-out of sale/sharing.”

All privacy laws
Applies in
California, United States
Companies must answer within
As soon as feasibly possible, and no later than 15 business days from receipt (11 CCR § 7026(f)(1)). The business must then wait at least 12 months before asking you to opt back in (11 CCR § 7026(k)).
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: privacy.ca.gov, oag.ca.gov, cppa.ca.gov

Last verified against the official page:

How we research this Report an error

California residents, and for-profit businesses covered by the CCPA that sell your personal information or share it for cross-context behavioral advertising (ads based on your activity across other sites and apps).

Your rights

  • Right to opt out of sale or sharing

    Tell a business at any time to stop selling your personal information or sharing it for cross-context behavioral advertising (Civ. Code § 1798.120).

  • No verification, no account

    The business can't require a verifiable request or make you create an account. It may only ask for what it needs to identify whose data to stop selling (11 CCR § 7026(c)-(d)).

  • One opt-out for everything

    The business can offer partial choices, but it must also offer a single option to opt out of all sale and sharing (11 CCR § 7026(h)).

  • Proof it worked

    The business must give you a way to confirm your opt-out was processed, such as an Opt-Out Request Honored message or a setting in your account (11 CCR § 7026(g)).

General information, not legal advice.

How to use it

  1. 1

    Look for the Do Not Sell or Share link

    Businesses that sell or share personal information must show a Do Not Sell or Share My Personal Information link (or an alternative opt-out link), and it must take you straight to the opt-out, without scrolling through a privacy policy (11 CCR § 7004(a)(5)(A)). If you can't find it, check the privacy policy.

  2. 2

    Or send the letter through another listed method

    Businesses must offer at least two ways to opt out. Others can include a toll-free number, email, or a form by mail or in person. Paste or send the letter below and keep a copy with the date.

  3. 3

    Turn on Global Privacy Control

    Global Privacy Control (GPC) is an opt-out signal your browser sends to the sites you visit. It's built into some browsers and available as an extension in others, and covered businesses must treat it as a valid request to stop selling or sharing your data. The Attorney General's GPC page explains it.

  4. 4

    Check it was processed

    The business has 15 business days. After that, look for the confirmation it has to provide, for example an Opt-Out Request Honored message on its site or a setting in your account.

  5. 5

    Report broken or hidden opt-outs

    If the link or method doesn't work or is hard to find, report the business to the Attorney General or file a complaint with CalPrivacy.

No answer in time? Complain to California Privacy Protection Agency (CalPrivacy) and the California Attorney General .

The letter

Fill in the parts in [brackets] before you send it.

Subject: Do Not Sell or Share My Personal Information (CCPA opt-out request)

[Your full name]
[The email address or phone number the business knows you by]
[Date]

To: [Business name], privacy team
[The opt-out method from the privacy policy: web form, email address or mailing address]

Dear [Business name] privacy team,

I am a California resident. Under the California Consumer Privacy Act (Civil Code section 1798.120), I direct you not to sell or share my personal information. This covers all sale and all sharing, including sharing for cross-context behavioral advertising.

[Optional, delete if you don't want it: Under Civil Code section 1798.121, I also ask you to limit the use and disclosure of my sensitive personal information.]

You can identify my records with these details:
- Name: [your name]
- Email address and phone number: [list]
- Account or customer number: [number, if any]

This is a request to opt out of sale and sharing, so please don't ask me to verify my identity or create an account.

Please:
1. stop selling and sharing my personal information as soon as feasibly possible, and no later than 15 business days after you receive this request;
2. notify any third parties to whom you sell or share my personal information between receiving this request and complying with it, direct them to comply with my request, and ask them to forward it to anyone they have passed my information on to in that time;
3. tell me how I can confirm that my opt-out has been processed.

[If an authorized agent is sending this: This request is sent on my behalf by [agent name], my authorized agent. My signed permission is attached.]

Sincerely,

[Your name]

Opting out isn't deleting

An opt-out stops a business selling your data or sharing it for targeted ads. The data stays where it is. If you want it gone, send a CCPA request to delete as well, and for data brokers use California's free DROP tool, which sends one deletion request to every registered broker. Our CCPA page covers the rest of your rights.

The upside of opting out is speed. There's no identity check, so a business can't hold it up over verification.

Why the letter asks for so little

The regulations limit what a business can ask for: only what it needs to know whose data to stop selling. So give your name and the email address or phone number the business would know you by, and nothing more. If it asks for an ID upload, it's asking for more than an opt-out needs.

The line about third parties covers data the business passes on between your request and the day it complies. It has to tell those recipients about your opt-out and ask them to pass it on too.

The sensitive data line is optional. It uses a separate right, under Civil Code § 1798.121, to limit how a business uses sensitive personal information.

Where Serus fits

An opt-out works company by company, and Global Privacy Control only reaches the sites you visit with it on. Data brokers that already hold your details need a removal request. Serus finds the data brokers and people-search sites that list you where you live, sends the removal requests, follows up and checks for relistings. Run a free scan to see where you're listed.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Frequently asked

Do I need to prove who I am to opt out?

No. A business shouldn't require identity verification. It may ask for information it needs to stop selling the right person's data, and can only use it for that.

Can a business refuse my opt-out?

Only in limited cases, such as legal obligations or legal claims, data that's exempt from the CCPA, or a documented good-faith belief that the request is fraudulent, which it must explain to you.

Is rejecting cookies the same as opting out?

No. A cookie banner or cookie controls on their own aren't an acceptable way to opt out, because cookies are about collection, not sale or sharing.

Does opting out delete my data?

No. It stops sale and sharing. To remove data, send a separate request to delete, or use DROP for data brokers.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.