The Footer Opt-Out Link Still Matters, Even With a Banner
The banner gets the design budget. The footer link gets ignored. Under California law the footer link is the part a visitor can actually use after the banner is gone, and it is the part regulators check when the banner is not in front of them.
CCPA, as amended by the CPRA, runs on opt-out for US visitors, not opt-in. The banner is the EU habit; the link is the California mechanism. A site that serves both has to run both, and the link has to work on its own, for a visitor who never saw a banner at all.
What the link has to say
The regulations give you two choices for the label. "Do Not Sell or Share My Personal Information" is the full form. "Your Privacy Choices" is the shorter form, but only if it carries the state-approved opt-out icon next to it. Either way the link has to be conspicuous: footer on every page where data is collected, not buried three clicks deep in a privacy policy. A link that opens a page explaining your policy is not an opt-out mechanism. It has to open a working control, immediately.
The wording matters because the law defines the terms. "Sell" and "share" are not colloquial here. Sharing includes cross-context behavioral advertising: passing data to an ad network so it can target the person elsewhere. Plenty of sites that insist they do not sell data are sharing it every page view, through pixels and real-time bidding scripts. If those tags run, the link belongs on the site.
The link is not the whole opt-out
The footer link is the manual route. The automatic route is the browser signal. Global Privacy Control sends Sec-GPC: 1 on every request and sets navigator.globalPrivacyControl to true, and California's regulations, 11 CCR 7025, treat that as a valid opt-out request for the browser and any profile linked to it. No click, no confirmation modal, no identity check. The CCPA allows fines up to $2,663 per violation and $7,988 per intentional violation, and the Sephora settlement in 2022, $1.2 million, included the company's failure to process opt-outs sent through GPC.
The two routes have to agree. A visitor who sends GPC and then clicks the footer link should find themselves already opted out, not asked to opt out again. A visitor who opts out through the link should have their tags stopped, not just a cookie set that the tag manager reads next week. And if the visitor is logged in, the opt-out has to follow the account across devices, not just the browser that sent it.
The three checks to run this week
First, click the link yourself, logged out, on a phone. Time how long it takes to reach a working control. If it is more than one screen, it is not conspicuous. Second, open the site with GPC on and watch the network tab: the ad pixels should not fire. If they do, the signal is being read and ignored. Third, check the status message. Since the updated regulations took effect on January 1, 2026, a business has to show on its website whether it processed the signal, for example with an "Opt-Out Request Honored" message. A silent opt-out is a gap now, not a courtesy.
Keep reading: The GPC Signal Is Not a Banner Setting. Test It Like a Request., Withdrawing Consent Should Take One Click. Count Yours., and When Purposes Change, Consent Has to Be Asked Again cover the nearby cases in this series.
Frequently asked questions
Do I need a Do Not Sell link if I already have a cookie banner?
Yes, if California law covers your business. The banner handles opt-in consent for EU visitors. The link is the opt-out route for California visitors, and it has to work for someone who never saw a banner.
Can the link just open my privacy policy?
No. It has to lead to a working opt-out control immediately. A page that explains your policy without letting the visitor act is not a mechanism, and regulators treat it as a missing one.
What if my site does not sell personal information?
Check the legal definition before deciding. Sharing for cross-context behavioral advertising counts as sharing under the CCPA, and most sites running ad pixels or real-time bidding are sharing data on every page view.
Does GPC replace the footer link?
No, both are required. GPC is the automatic route for visitors whose browsers send it. The link is the manual route for everyone else. They have to agree: a GPC visitor who clicks the link should find themselves already opted out.