The California Privacy Rights Act, which is scheduled to go into effect in 2023, states that if a company “shares” personal information with a third party that is engaged in cross-context behavioral advertising, the company must provide the consumer with the ability to “opt-out” of the sharing.¹ Furthermore, under the CPRA a business must either (1) provide a link on the business’s homepage titled “Do Not Sell or Share My Personal Information” or (2) recognize “opt-out preference signal[s]” that are sent with the consumer’s consent pursuant to a technical specification that is to be created by the California Privacy Protection Agency.² There is, however, an exception built into the CPRA for instances in which a consumer consents (i.e., opts-in) in the first instance to the use of behavioral advertising. Specifically, the CPRA states that if a consumer “uses or directs” a business to “intentionally disclose personal information or intentionally interact with one or more third parties” then such disclosures do not constitute “sharing” for the purposes of the CPRA.³ If an activity does not constitute sharing, then the CPRA’s requirement to provide an opt-out mechanism does not apply.

The net result is that there is a strong argument that if a company obtains opt-in consent from a consumer for the use of third party behavioral advertising in the first instance (e.g., through an opt-in cookie banner) then the company is not required to post a Do Not Sell or Share My Personal Information link and is also not required to comply with opt-out preference signals.⁴

FOOTNOTES

¹ Cal. Civ. Code §1798.120(a) (West 2021).

² Cal. Civ. Code § 1798.135(a), (b)(1) (West 2021).

³ Cal. Civ. Code § 1798.140(ah)(2)(A) (West 2021).

⁴ It is worth noting that the CPRA does not state that in order for an intentional use or direction from a consumer to be effective, a business must provide the consumer with a means to revoke, or withdraw, that direction. Put differently, there is nothing within the CPRA that suggests that for consent to be effective a consumer must be given the ability to withdraw the consent at a later time. It is possible, however, that the CPPA may attempt to follow jurisdictions outside of California that have held that effective consent requires the ability of a consumer to withdraw.