Do Not Sell or Share: How Opt-Out Rights Work

"Do Not Sell or Share My Personal Information" is the most visible right in US state privacy law, and one of the most misunderstood. The words "sell" and "share" are defined far more broadly than an exchange of money, which is why many businesses that would never say they sell data are still on the hook for an opt-out.

What "Sell" and "Share" Actually Mean

Under CCPA/CPRA, the definitions are deliberately wide:

• Sell means disclosing personal information to a third party for money or other valuable consideration. The "other valuable consideration" is the catch: you do not need to be paid for a disclosure to count as a sale.
• Share was added by CPRA and specifically covers disclosing personal information for cross-context behavioral advertising, whether or not money changes hands.

In practice, common advertising and analytics setups, where data flows to ad-tech or marketing partners, frequently qualify as a sale or share even when no one thinks of it that way.

How a Compliant Opt-Out Has to Behave

An opt-out is not just a link. To hold up, it generally has to:

• Be easy to find and use, typically a clear "Do Not Sell or Share My Personal Information" link or an equivalent control.
• Actually stop the data flows it covers, not just record a preference while trackers keep firing.
• Honor a recognized opt-out signal where the law requires it, such as the Global Privacy Control (see Global Privacy Control).

That middle point is where compliance most often breaks: a banner that logs an opt-out but does not block the tags is a gap, not compliance.

How Concord Fits

Concord Privacy's consent management does not just capture a preference, it blocks trackers and scripts in real time based on that choice, and it can honor a browser-level opt-out signal automatically. The opt-out link changes the data flow, which is the part the law actually cares about.