Laws and fines

CCPA for websites: the “Do Not Sell or Share” link and US fines

When a site needs an opt-out link, what the GPC signal is, and what a CCPA violation costs.

Checked against sources: 30 September 2026

  • $2,663per violation
  • $7,988per intentional violation
  • $1.2Mpaid by Sephora, 2022

The US works differently from the EU

California does not require consent before cookies load. Instead a resident may forbid the sale and sharing of their data for advertising, and the site must let them. That is why the US check has no “consent before loading” rule but does have an opt-out link rule.

Who it applies to

CCPA covers for-profit businesses that do business in California and meet one threshold: annual revenue above $25M (indexed), data of 100,000 or more residents or households, or half of revenue from selling or sharing data. Regardless of thresholds, any site that collects data from California residents needs a published policy: that is CalOPPA.

What to do

  • Add a “Do Not Sell or Share My Personal Information” or “Your Privacy Choices” link to the footer.
  • Honor the Global Privacy Control browser signal: it counts as an opt-out without a click.
  • Do not load advertising pixels for people who opted out.
  • Describe in the policy what data is shared and with whom.

What a violation costs

After the 2025 inflation adjustment, the fine is up to $2,663 per violation and up to $7,988 if the violation is intentional or involves children under 16. It is counted per affected resident, so totals grow fast. In 2022 Sephora paid $1.2M for ignoring the GPC signal and not disclosing the sale of data.

Frequently asked

Must the link use exactly that wording?

Two forms are accepted: “Do Not Sell or Share My Personal Information” and “Your Privacy Choices” (with the toggle icon). The link must be conspicuous and lead to a working opt-out.

What does Awe Check test for the US?

Whether a policy exists and whether an opt-out link is present when ad pixels, session replay or social embeds are found. With no such scripts the rule does not apply.

Sources

Check your site

Awe Check shows in a minute which of this is broken on your site and calculates the possible fine.

Check a site