methodology / Privacy & Compliance / #50

CCPA "Do Not Sell or Share My Personal Information" link

#50 · Required · Web Standards · legal · Privacy & Compliance · weight 0.7% · impl implemented · method v1.2.0

Web Standards item — Legal

This factor is part of Web Standards — the table-stakes binary layer of the score. It is graded pass/fail and gates the Web Quality score; it is not weighted into Web Quality itself.

Pass criteria: Tolerant — passes on pass or warn.
Web Standards label: CCPA opt-out link
Excluded for: Personal site, Blog
Only in: United States
Why it's required: California requires a 'Do Not Sell or Share' link on commercial sites that handle CA-resident data.

Same factor, two depths.

What we measure

California law requires this link in your footer if you sell or share personal data. It's a common gotcha — the rule applies to most ad-supported sites, even small ones.

How to improve your score

Add a footer link to a "Do Not Sell or Share My Personal Information" form. Your CMP can usually generate this automatically.

Facts

Ticket

WEBQ-50

Implementation notes

Parse the footer for the literal phrase or a `data-ccpa` attribute.

When this applies

CCPA "Do Not Sell or Share" is a California requirement; non-US sites follow GDPR / local equivalents.

Only scored for jurisdictions: United States.

Scoring

Scoring formulas are versioned with the methodology. The current method (v1.2.0) maps raw measurements to pass, warn, fail. Factor weights determine how much each contributes to the composite — see the methodology index for the full table.

Cited by these standards

Standards in the Standards Library whose satisfiedBy requirement tree references this factor. Each link goes to the standard's full entry — methodology, scope, and the other factors it relies on.

CCPA / CPRA Privacy US California's privacy law. The visible signal is the 'Do Not Sell or Share My Personal Information' link in your footer.
Colorado Privacy Act Privacy US Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
Connecticut Data Privacy Act Privacy US Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
Oregon Consumer Privacy Act Privacy US Oregon's CCPA-shaped privacy law. Distinctive for explicitly covering nonprofits (after a one-year delay) and for a specific right to know which third parties received your data.
Texas Data Privacy and Security Act Privacy US Texas's CCPA-shaped privacy law. Notable for ditching the consumer-count threshold — almost any business doing business in Texas is in scope, except small businesses as defined by the SBA.
Utah Consumer Privacy Act Privacy US Utah's CCPA-shaped privacy law, the most business-friendly of the bunch. Higher revenue threshold, no UOOM requirement (yet), and a permanent 30-day cure period.
Virginia CDPA Privacy US Virginia's CCPA-shaped privacy law. Applies if you process the data of 100K+ Virginia residents (or 25K+ if you derive 50%+ revenue from selling data). No private right of action — Virginia AG enforces.

Version history

Version	Change	Date
v1.2.0	Factor introduced. Status: live. Scoring impl: implemented.	2026-04-25

← back to methodology