A privacy preference that tells an organisation not to disclose a person’s data for sale or sharing with third parties. Under privacy laws, this consent choice requires systems to record, honour, and propagate the request across customer, marketing, analytics, and identity workflows, while preserving evidence of compliance.
What “Do Not Sell Or Share My Personal Information” Means in Practice
This choice is a privacy control, not just a notice preference. It tells an organisation that a person has exercised a legally recognised right to restrict data sales or cross-context sharing, and the organisation must treat that preference as an actionable rule across systems.
Because the request can touch customer data, marketing data, analytics tags, and identity-linked profiles, the organisation has to resolve it as a policy decision rather than a one-off form submission. The core challenge is consistency: once recorded, the preference must follow the person wherever their data is used.
Why This Preference Matters for Data Flow Governance
The phrase matters because “sale” and “sharing” are operational concepts as much as legal ones. In practice, organisations need a way to distinguish first-party service processing from transfers that trigger opt-out obligations, then apply that distinction across vendors, trackers, and internal platforms.
That governance burden is especially important when identifiers are used to connect records across channels. If the opt-out is not mapped to the same person everywhere, one system may continue disclosure even after another system has recorded the request.
How Organisations Honour the Request Across Systems
Honouring this preference requires more than a single preference centre. The request has to propagate into customer databases, CRM tools, marketing platforms, analytics pipelines, cookie or SDK consent layers, and any downstream export or enrichment process that might disclose the data.
A reliable implementation also needs evidence. Organisations should be able to show when the request was captured, which data subject it applied to, which systems received it, and how long it took for the preference to take effect.
For organisations working under US state privacy regimes, NHIMG’s US State Privacy Laws Guide is a useful reference point for comparing opt-out requirements, universal opt-out mechanisms, and enforcement patterns.
Common Failure Modes and Compliance Implications
The most common failure is fragmentation: one channel honours the request while another still shares the person’s data through a vendor, ad-tech tool, or analytics integration. Another common weakness is identity mismatch, where the opt-out is stored against one account, browser, or device but not reconciled with other identifiers that point to the same person.
Those gaps matter because privacy violations often appear as ordinary data flows, not obvious incidents. If the organisation cannot prove that the preference was propagated, the issue becomes both a privacy compliance problem and a trust problem, especially where third-party disclosures are part of the business model.
Risk and Threat Considerations
When this preference is not enforced consistently, personal information can continue flowing to advertising, analytics, data broker, or partner systems after the individual has opted out. The risk is not only legal exposure, it is also loss of trust, because the organisation has kept using data in a way the person explicitly tried to stop.
Failure mechanism: Preference data is stored in one system but not synchronised to all downstream processors, or the organisation cannot reliably match the opt-out to every active identifier tied to the person.
Impact: Data may still be sold or shared, creating consent drift, compliance failure, evidentiary gaps, and repeated disclosure through integrated third-party workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while GDPR and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Article 21 — Right to object | Materially governs an individual's objection to certain personal data processing, including some direct-marketing uses. |
| Recommendation — Record and enforce objections so downstream processing stops where Article 21 requires it. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | Directly addresses governance controls for protecting personal information and privacy requirements. |
| Recommendation — Map opt-out handling into privacy controls that preserve PII protection across systems. | ||
| NIST CSF 2.0 | GV.OC-03 — Roles, responsibilities, and authorities | Defines accountability for privacy-related obligations and cross-functional ownership of the opt-out process. |
| PR.DS-01 — Data-at-rest is protected | Supports protection of stored preference and identity-linked personal data used to honour the request. | |
| PR.AA-01 — Identity and access credentials and authenticators are issued, managed, verified, revoked, and audited | Supports controlled handling of identity-linked workflows that carry the opt-out state across systems. | |
| Recommendation — Assign clear ownership for preference capture, propagation, and evidence retention. Protect stored preference records and linked personal data from unauthorized disclosure. Control identity-linked access paths so the preference state is consistently applied and audited. | ||
Practitioner Guidance
Governance implication: Treat this as a lifecycle control over personal-data disclosure, not a UI setting. Ownership should sit with privacy and data-governance functions together, because the request has to be honoured across product, marketing, analytics, and vendor operations.
What to watch for: Mismatches between the source of truth for preference status and the systems that actually perform outbound sharing. If the organisation cannot trace propagation, it cannot confidently claim the opt-out is being respected.
Practitioner takeaway: The control is only real when the preference survives account merges, cross-channel identifiers, and vendor handoffs.
Related resources from NHI Mgmt Group
- Do Not Sell My Personal Information Link
- Why does POPIA create risk for organisations that collect and share personal information broadly?
- What is the difference between consumer health data and personal information in the Washington My Health My Data Act?
- What happens when organisations share files without redacting personal information first?