Understanding The CPRA Opt-Out: Process, Implementation, and Rights
The California Privacy Rights Act (CPRA), which enhances the California Consumer Privacy Act (CCPA), provides consumers with greater control over their personal information. One of the key provisions of the CPRA is the ability to opt out of the sale and sharing of personal information. This article explains the CPRA opt-out process, how to exercise your rights, and what actions to take if a company does not comply with your opt-out request.
What is CPRA Opt-Out?
The CPRA allows California residents to opt out of the sale or sharing of their personal information. “Sale” refers to the exchange of personal information for monetary or other valuable consideration, while “sharing” pertains to the disclosure of personal information for cross-context behavioral advertising, irrespective of any monetary consideration.
How to Opt Out
- Locate the Opt-Out Link
- Companies that sell or share personal information are required to provide a clear and conspicuous link titled “Do Not Sell or Share My Personal Information” on their homepage.
- Submit the Opt-Out Request
- Click the opt-out link and follow the instructions provided to submit your request. You may need to provide some personal information to verify your identity.
- Opt-Out Preference Signal
- The CPRA also recognizes opt-out preference signals sent from a browser or device, such as the Global Privacy Control (GPC). This signal communicates your opt-out request automatically to websites you visit, without requiring you to take any additional steps.
- Confirmation of Opt-Out
- After submitting your opt-out request, the company must respect your choice and refrain from selling or sharing your personal information. You should receive a confirmation of your request, either immediately through the website or via email.
What Happens After Opting Out
- Implementation of Opt-Out Request
- Companies must honor your opt-out request within 15 business days. During this period, they should stop selling or sharing your personal information and ensure that any third parties with whom they have shared your data are also informed of your decision.
- Impact on Services
- Opting out should not affect the core services provided by the company. However, some personalized features or advertisements may change as a result of your decision.
- Duration of Opt-Out
- Your opt-out request remains in effect unless you decide to opt back in. Companies are required to maintain records of your opt-out status to ensure ongoing compliance.
Filing a Complaint
If a company fails to honor your opt-out request, you can take the following steps:
- Contact the Company
- Reach out to the company’s privacy or customer service department to inform them of the issue. Provide details of your original opt-out request and any confirmation you received.
- File a Complaint with the CPPA
- If the company does not resolve the issue, you can file a complaint with the California Privacy Protection Agency (CPPA). The CPPA is responsible for enforcing the CPRA and investigating violations.
- You can submit your complaint through the CPPA’s online complaint portal or by mail. Provide all relevant information, including details of your opt-out request and any communication with the company.
- Seek Legal Action
- In cases of significant non-compliance, you may consider seeking legal advice to explore further actions, such as filing a lawsuit for damages caused by the violation of your privacy rights.
Conclusion
The CPRA opt-out provision empowers California residents to control the sale and sharing of their personal information. By understanding the opt-out process and knowing how to assert your rights, you can better protect your privacy. If a company fails to comply with your opt-out request, there are steps you can take to file a complaint and seek enforcement of your rights.
If you need help setting up your site or business to be CPRA Compliant contact Captain Compliance for assistance.
