Topic starter
11/07/2026 8:22 pm
TL;DR: The amended CCPA folds sharing for cross-context behavioural advertising into the same consumer-rights workflow as sale, according to OneTrust. Privacy teams now have to prove that opt-outs are carried through systems, vendors, and records, not just captured once.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Navigating the CCPA As Amended “Do Not Sell or Share” Requirement”.
Key questions
Q: Why do CCPA opt-out programs fail when data flows are not mapped?
A: They fail because the business cannot tell where sale or sharing occurs, so the consumer choice cannot be enforced consistently.
Q: What are the signs that a do not sell or share control is not working?
A: The clearest signs are inconsistent preference state across channels, vendors that keep receiving data after an opt-out, and records that cannot prove when a choice was applied.
Q: How should organisations operationalise CCPA Do Not Sell or Share requests across systems?
A: Organisations should map every place personal information is sold or shared, then connect the opt-out workflow to downstream systems that consume that data.
Practitioner guidance
- Map data sharing pathways end to end Identify where personal information is sold or shared, including internal tools, adtech partners, and downstream processors, so opt-out logic can be enforced across the whole chain.
- Separate sensitive data workflows Create distinct handling paths for sensitive personal information so notices, limits, and review logic do not rely on generic privacy settings.
- Automate consumer choice persistence Store opt-out decisions in a preference layer that can survive channel changes and remain effective for at least twelve months before reconfirmation.
Bottom line: The amended CCPA makes sharing for cross-context behavioural advertising part of the same consumer-rights workflow as sale, which raises the bar for operational governance.
Glossary terms: Cross-Context Behavioural Advertising, Consumer Opt-Out Signal, Sensitive Personal Information, Preference Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 8:53 pm
Consent preference sprawl: the real control gap in amended CCPA compliance is fragmented preference state across web, mobile, and third-party data flows. If the opt-out exists in one channel but not in another, the business has created a governance inconsistency, not a compliant programme. Practitioners should treat preference propagation as a state-management problem with legal consequences.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
A: They should treat them as part of the governance model because the signal is only useful if it is recognised across systems and partners. Browser-based preferences matter when they are connected to downstream enforcement, logging, and retention. If the signal stops at the edge, the business has not honoured the consumer right in practice.
👉 Read our full editorial: CCPA Do Not Sell or Share rules sharpen privacy governance