Topic starter
11/07/2026 8:22 pm
TL;DR: California’s CCPA as amended now extends the “Do Not Sell or Share My Personal Information” right to sharing for cross-context behavioural advertising, requires clear opt-out links and downstream honouring of consumer choices, according to OneTrust. The practical challenge is governance, not just page design: privacy teams must operationalise preference capture, vendor enforcement, and auditable records across data flows.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Navigating the CCPA As Amended “Do Not Sell or Share” Requirement”.
Key questions
Q: How should organisations operationalise CCPA Do Not Sell or Share requests across systems?
A: Organisations should map every place personal information is sold or shared, then connect the opt-out workflow to downstream systems that consume that data.
Q: Why do CCPA opt-out programs fail when data flows are not mapped?
A: They fail because the business cannot tell where sale or sharing occurs, so the consumer choice cannot be enforced consistently.
Q: What are the signs that a do not sell or share control is not working?
A: The clearest signs are inconsistent preference state across channels, vendors that keep receiving data after an opt-out, and records that cannot prove when a choice was applied.
Practitioner guidance
- Map data sharing pathways end to end Identify where personal information is sold or shared, including internal tools, adtech partners, and downstream processors, so opt-out logic can be enforced across the whole chain.
- Separate sensitive data workflows Create distinct handling paths for sensitive personal information so notices, limits, and review logic do not rely on generic privacy settings.
- Automate consumer choice persistence Store opt-out decisions in a preference layer that can survive channel changes and remain effective for at least twelve months before reconfirmation.
Bottom line: The amended CCPA makes sharing for cross-context behavioural advertising part of the same consumer-rights workflow as sale, which raises the bar for operational governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:53 pm
Consent preference sprawl: the real control gap in amended CCPA compliance is fragmented preference state across web, mobile, and third-party data flows. If the opt-out exists in one channel but not in another, the business has created a governance inconsistency, not a compliant programme. Practitioners should treat preference propagation as a state-management problem with legal consequences.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
A: They should treat them as part of the governance model because the signal is only useful if it is recognised across systems and partners. Browser-based preferences matter when they are connected to downstream enforcement, logging, and retention. If the signal stops at the edge, the business has not honoured the consumer right in practice.
👉 Read our full editorial: CCPA Do Not Sell or Share rules sharpen privacy governance