The Do Not Sell Link on a Small Site: What It Has to Do and Where It Has to Live
A site with four pages, a contact form, and a few hundred visitors a month got a letter about its missing do-not-sell link. The owner had assumed the California rules were for big companies. They are not. The law reaches any business that does business in California and meets its thresholds, and the thresholds are lower than most small sites think. The link is not optional, and the rules about it are exact.
The exact words
The link has to carry the exact title: Do Not Sell or Share My Personal Information. Not a paraphrase, not a shorter version, not a friendlier one. The exact words exist so the visitor recognizes the link on any site, and so the regulator can check it without interpretation. A link that says Privacy Choices or Manage My Data does not count, even if it leads to the same page.
The link also has to be honest about what it does. Clicking it has to open a working opt-out, not a page that explains the concept of opting out. The opt-out has to flip the sale and sharing flags, and it has to do so for the visitor who clicked, not for a hypothetical visitor who fills in a form and waits for an email.
Where it has to live
The link belongs in the footer, in the first row, with the same weight as the other links there. It cannot be buried in a submenu, hidden behind a smaller font, or placed on a page the visitor has to find first. The California rules are specific about this because the history is full of links that technically existed and practically did not. A link in the footer that a visitor can find without hunting is the standard, and the test is whether a person who has never seen the site can find it in ten seconds.
The same rule applies to the GPC signal. The site has to display whether it processed the opt-out signal, and the January 2026 regulations made that display a requirement, not a courtesy. A visitor who sends the signal should be able to see that it worked, without opening the developer tools.
The clock after the click
Two clocks start when the visitor opts out. The first is the confirmation clock: the business has to confirm the opt-out within 15 business days. The second is the re-ask clock: the site cannot ask the visitor to opt back in for 12 months. Both are enforceable, and both are the kind of thing a regulator checks, because both leave a paper trail.
The symmetry rule matters here too. The January 2026 regulations require the opt-out path to take the same number of steps, or fewer, than the opt-in path. An opt-in that takes one click and an opt-out that takes a form, an email confirmation, and a phone call is a violation, and it is a violation that shows in the design, not just in the record. Count the steps. If opting out takes more steps than opting in, fix the design.
The stakes are concrete. The fine is 2,663 dollars per violation under the 2025 figures, and 7,988 dollars per intentional violation. A small site does not need a large number of violations to feel that. The link is cheap. The fine is not.
Keep reading: what happens when cleared cookies trigger a re-prompt, and how consent renewal intervals work cover the nearby cases in this series.
Frequently asked questions
What exact words does the do-not-sell link have to use?
The exact title is Do Not Sell or Share My Personal Information. A paraphrase does not count. The words exist so the visitor recognizes the link on any site and the regulator can check it without interpretation.
Where does the do-not-sell link have to live?
In the footer, in the first row, with the same weight as the other links there. It cannot be buried in a submenu, hidden in a smaller font, or placed on a page the visitor has to find first. A person who has never seen the site should find it in ten seconds.
How long do I have to confirm an opt-out?
Within 15 business days. And the site cannot ask the visitor to opt back in for 12 months after they opt out. Both clocks are enforceable, and both leave a paper trail a regulator can check.
What is the symmetry rule for opt-outs?
The January 2026 regulations require the opt-out path to take the same number of steps, or fewer, than the opt-in path. An opt-in that takes one click and an opt-out that takes a form, an email, and a phone call is a violation. Count the steps on both paths.