If you build or manage websites for other people, here is the direct answer to who needs a "Do Not Sell or Share My Personal Information" link in 2026: any business that falls under a US state privacy law and sells or shares personal information for cross-context behavioral advertising needs it, and in practice that sweeps in far more of your clients than most agencies assume, because "sharing" includes the ordinary advertising and analytics trackers on a typical marketing site. If a site loads Meta Pixel, Google Ads tags, or similar third-party advertising tools and serves US visitors, it very likely needs an opt-out mechanism. The link itself is the visible tip of that obligation. This guide explains exactly who is covered, how to check a site in about five minutes, how to add the link properly, and the one thing no automated scanner can decide for you.
We work with a lot of agencies and freelancers who look after other people's sites, and the pattern is always the same: everyone knows the link exists, almost nobody is sure whether their particular client needs it, and the "Your Privacy Choices" variant adds a layer of confusion on top. So let us clear it up properly, with the current primary sources cited at each step, because this is an area where the rules genuinely changed in 2026 and memory is not good enough.
Do I need a "Do Not Sell or Share" link on my website?
You need it if two things are both true: your client's business is subject to a US state privacy law, and the business sells or shares personal information. The second condition is the one that surprises people. Under the California Consumer Privacy Act, "sharing" specifically covers disclosing personal information for cross-context behavioral advertising, which is the technical term for the retargeting and ad-personalization that most marketing sites do by default. According to the California Attorney General's CCPA page, businesses that sell personal information must provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link that lets a consumer submit an opt-out request. If a site runs advertising pixels that pass identifiers to third parties, that activity often meets the legal definition of "sharing," even though no money changes hands and the business would never describe itself as "selling data."
The threshold question of whether the business is even covered matters too, and it is not every company. The CCPA applies to for-profit businesses that meet certain thresholds, broadly, significant revenue, large volumes of personal information, or deriving revenue from selling or sharing data. So a tiny local business with no ad tech may fall outside it, while a mid-sized ecommerce client with a full marketing stack is squarely inside. As an agency, your job is not to make the final legal call, but to recognize when a client is clearly in the zone where they need the link and to raise it before a regulator or a complaint does.
What is the difference between "Do Not Sell" and "Do Not Sell or Share"?
This trips up a lot of people because the older label is still floating around the web. The original CCPA link read "Do Not Sell My Personal Information." When the California Privacy Rights Act (CPRA) amended the CCPA, it added the right to opt out of sharing, not just selling, and the link text was updated to "Do Not Sell or Share My Personal Information" to reflect that. There is no separate "CPRA law" to comply with; the CPRA rewrote the CCPA, so what is in force today is the CCPA as amended.
The practical upshot for you is simple: use the current wording. A site still showing only "Do Not Sell My Personal Information" is using outdated language that omits the sharing right, which is exactly the retargeting-advertising activity most sites actually do. When you audit a client site and find the old text, updating it to "Do Not Sell or Share My Personal Information" is a quick, worthwhile fix.
Is "Your Privacy Choices" the same link?
Yes, and this is the alternative that confuses everyone. Rather than posting two separate links, one for the sale/share opt-out and one for the right to limit sensitive personal information, businesses may use a single combined link. According to the California Privacy Protection Agency's official opt-out icon and guidance from the California AG, the alternative link must be titled "Your Privacy Choices" or "Your California Privacy Choices" and must display the official opt-out icon next to that title. The icon is a specific blue toggle graphic the state provides for download, and it is not optional decoration; if you use the "Your Privacy Choices" route, the icon is part of the requirement.
So both approaches are valid. You can post "Do Not Sell or Share My Personal Information" (optionally alongside a separate "Limit the Use of My Sensitive Personal Information" link), or you can post the single "Your Privacy Choices" link with the official icon. For most agency clients, the combined "Your Privacy Choices" link is the cleaner choice because it covers both rights in one place and reads less alarmingly to customers. Whichever you pick, it needs to sit somewhere clear and conspicuous, conventionally the site footer, on the homepage and on any page that collects personal information.
What states require a "Do Not Sell or Share" link in 2026?
The landscape expanded fast, so this is worth stating with current numbers. As of early 2026, twenty US states have comprehensive consumer privacy laws in effect, and all of them provide some form of opt-out right for the sale or sharing of personal information or for targeted advertising. California is the one that uses the specific "Do Not Sell or Share" and "Your Privacy Choices" link conventions, but the underlying opt-out obligation now exists across a large and growing bloc of states.
The good news for anyone managing sites is that these laws were largely modeled on the same template, so a single, well-built opt-out page and a footer link can serve residents across many states at once. You do not need twenty different mechanisms. You need one solid opt-out flow that honors the rights and one clearly labeled link, plus the technical piece we will get to next, which is where a lot of otherwise-compliant sites quietly fail.
What is Global Privacy Control, and do I have to honor it?
This is the part agencies most often miss, and in 2026 it is not optional. Global Privacy Control (GPC) is a signal a visitor's browser sends automatically that communicates their choice to opt out of the sale or sharing of their personal information, without them clicking anything on your site. According to the official Global Privacy Control project, the CCPA requires businesses to treat a user-enabled GPC signal as a legally valid opt-out request. The California Attorney General has confirmed this, and it means a manual "Do Not Sell or Share" link on its own does not make a site compliant, because the site must also detect and honor the browser signal.
The reason this matters so much in practice is that the signal is already everywhere. Browsers including Firefox and Brave can send GPC by default, so client sites are very likely already receiving these signals whether or not anyone built the site to notice them. A site with a perfect footer link that silently ignores GPC is failing the exact thing regulators are actively enforcing. In fact, according to the California Privacy Protection Agency's own announcement, in September 2025 the CPPA and the Attorneys General of California, Colorado, and Connecticut launched a joint investigative sweep specifically targeting businesses that fail to process GPC opt-out requests. Honoring the signal is now a coordinated, multi-state enforcement priority, not a theoretical one. On the technical side, honoring GPC means detecting the signal, either the navigator.globalPrivacyControl property client-side or the Sec-GPC request header server-side, and treating it as an opt-out for that visitor, and since January 2026 California also expects a visible confirmation that the signal was recognized. This shift toward browser-level consent is part of a larger trend we cover in our look at the future of cookie banners and browser signals, which is worth reading if you manage consent for clients.
How do I add the link, and what happens when someone clicks it?
Adding the link is the easy part; making the destination actually work is where the care goes. Place a clear, conspicuous link in the footer, "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" with the icon, on the homepage and any page collecting personal information. That link should lead to a page or mechanism where the visitor can actually exercise the opt-out.
What happens after the click is governed by specific rules, and this is where you protect your client. The request must be easy to submit with no account required, because opt-out is not the same as a data-access request and does not need identity verification. You must offer at least two methods to opt out, so a single web form usually needs a companion method such as an email address or a toll-free number, depending on how the business operates. Once a request arrives, according to the California Privacy Protection Agency's consumer FAQ, the business must comply as soon as feasibly possible and no later than 15 business days from receipt. After a consumer opts out, the business is then prohibited from selling or sharing that person's information and generally must wait at least 12 months before asking them to opt back in. And critically, the opt-out flow must be as easy to use as the opt-in, because dark patterns that add friction to the "no" are explicitly prohibited.
For the "how" of building the opt-out itself, the mechanics usually come down to suppressing the advertising and analytics trackers that constitute "sharing" for that visitor, which ties this obligation directly to how your consent and tag setup is built. Getting that plumbing right is the same discipline we describe in our guide to what your website legally needs for cookie consent, region by region, because a "Do Not Sell or Share" choice that does not actually stop the tracking is the same failure as a cookie banner that ignores a rejection.
What are the penalties for getting this wrong?
Enough to make this a real line item in a client conversation, and enforcement in 2026 has been active rather than hypothetical. California can levy civil penalties per violation, with a higher tier for intentional violations, and because the CPRA removed the old 30-day cure period, regulators no longer have to give a business a chance to fix the problem before penalties attach. The opt-out link and GPC handling sit right at the center of recent enforcement.
The dollar figures make the point. The California Attorney General's 2022 settlement with Sephora for $1.2 million over failing to honor GPC signals was an early warning, and enforcement has escalated since. In the first quarter of 2026 alone, California regulators announced several million dollars in penalties against companies over opt-out failures, including a widely reported $2.75 million settlement with Disney, alongside actions against other businesses in the same window. When a regulator can act without a cure period and is running coordinated multi-state sweeps, an ignored opt-out obligation stops being a paperwork risk and becomes a financial one. For agencies, that is the argument that moves a client from "we'll get to it" to "let's fix it this week."
How do I check a client site in five minutes?
Here is the fast triage pass you can run on any site before a deeper review. First, open the homepage and look in the footer for a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link; note whether it exists at all, whether it uses current wording, and whether the "Your Privacy Choices" version includes the official icon. Second, open the site's network activity in your browser dev tools and watch for third-party advertising and analytics requests firing on load; if you see ad-tech identifiers going out, the site is very likely "sharing" and needs the mechanism. Third, check whether the site responds to a GPC signal by enabling GPC in a supporting browser and seeing whether anything changes. Fourth, click the opt-out link and confirm the destination actually lets you opt out without forcing account creation, and that a second method is offered. Fifth, scan the site to inventory exactly which trackers load and where, so you know the scope of what "sharing" means on this particular site. You can run a free scan to see the third-party trackers present across the pages, which turns "I think this site shares data" into a concrete list you can act on.
That five-minute pass will not give you a legal opinion, but it will tell you reliably whether a site is in obvious trouble, roughly compliant, or somewhere in between that needs a closer look and a conversation with the client's counsel.
What a scanner can and cannot tell you
This is the honest boundary, and it matters most for agencies because it is where you add value a tool cannot. An automated scan is excellent at the observable facts: whether a "Do Not Sell or Share" or "Your Privacy Choices" link is present, whether the wording and icon are correct, whether advertising and analytics trackers are firing, and whether obvious opt-out plumbing exists. Those are the things you can see by inspecting a page, and they are exactly what you want a scanner to inventory quickly across a whole site.
What a scanner fundamentally cannot decide is the legal predicate underneath the whole obligation: whether the business actually sells or shares personal information as the law defines it, and whether the business meets the coverage thresholds in the first place. Those depend on facts that live inside the business, its data contracts, its revenue, its actual data flows to third parties, not on anything visible in the page source. A tool can tell you a site loads Meta Pixel; only a human, ideally with legal input, can confirm whether that constitutes "sharing" for this business and whether this business is even in scope. So the right workflow is to let a scan handle the fast, factual inventory and flag the candidates, then apply human judgment and, where the stakes warrant it, qualified legal advice to the decision itself. That division of labor is the professional answer, and it is why an agency that understands this is worth more to a client than any automated report alone.
For agencies that want a fast, factual starting point across a client's whole site, a compliance scanner like Sitejar is a sensible first pass, and you can read how the company approaches data handling on its privacy page or browse related explainers in the privacy writing on the Sitejar blog. Use the scan to see what is objectively there; keep the "does this business sell or share" judgment where it belongs, with people.
The bottom line
The "Do Not Sell or Share My Personal Information" link is required for businesses that are covered by a US state privacy law and that sell or share personal information, and because "sharing" includes the ordinary advertising and analytics trackers on most marketing sites, more of your clients need it than you might expect. Use the current wording, or the "Your Privacy Choices" link with the official icon, place it clearly in the footer and on data-collection pages, and, above all, honor Global Privacy Control, because a link that ignores the browser signal is exactly what the 2026 multi-state enforcement sweeps are hunting. Build an opt-out that needs no account, offers at least two methods, responds within 15 business days, and actually stops the tracking. Then remember the one thing a scanner cannot do for you: deciding whether a business truly sells or shares is a human call, informed by facts a tool cannot see. Run the scan for the inventory, make the judgment with your client, and get counsel involved when the stakes are real. None of this is legal advice, and for a specific site the safe move is always to confirm with a qualified attorney.
Sources
California Attorney General, California Consumer Privacy Act (CCPA)
California Attorney General, CCPA Opt-Out Icon Download
California Privacy Protection Agency, Consumer FAQ
California Privacy Protection Agency, Joint Investigative Sweep Announcement (September 2025)
This article is educational and reflects Sitejar's point of view. It is not legal advice. For your specific situation, consult a qualified attorney.