CCPA Opt-Out Failures

California has long served as the leader in progressive consumer privacy protection and when the California Consumer Privacy Act took effect in 2020, it represented the most comprehensive data privacy legislation any state had enacted. Still, a significant number of businesses subject to the CCPA are not actually complying with the right to opt out of the sale or sharing of personal information.

Some instances may also constitute violations of California's Unfair Competition Law, opening the door to private litigation and injunctive relief. Contact our data privacy attorneys if you believe you have a related claim.

What the CCPA Requires

The CCPA grants California residents several enforceable rights over their personal data and among the most important is the right to direct a business to stop selling or sharing their personal information with third parties. To honor this right, companies must provide a clear and conspicuous opt-out mechanism, such as a "Do Not Sell or Share My Personal Information" link placed prominently on the homepage and throughout the website.

The California Privacy Rights Act, which amended and strengthened the CCPA, made these requirements more demanding. Businesses that use targeted advertising or have relationships with data brokers must ensure their opt-out mechanisms actually function. A link that leads to a broken page or a process so cumbersome that a reasonable consumer would abandon it before completing it can constitute noncompliance.

Data Collection Opt-Out Violations

Common violations include opt-out links that are buried in fine print rather than displayed prominently, forms that require consumers to submit personal information just to exercise their privacy rights, global privacy control signals that websites fail to recognize or honor, and opt-out preferences that expire automatically or reset without user action.

California's Unfair Competition Law prohibits any business practice that is unlawful, and a company can face UCL liability even if its conduct does not constitute a standalone statutory violation, as long as it qualifies as unfair or deceptive by the statute's broad standards.

The Business Practices Drawing the Most Scrutiny

California Attorney General recently announced a settlement with the Walt Disney Company, resolving allegations that the company violated the California Consumer Privacy Act by failing to fully effectuate consumer requests to opt-out of the sale or sharing of their data across all devices and streaming services.

Data brokers and people-search websites have faced claims for making opt-out processes nearly impossible to complete without providing additional personal information.

Retailers and e-commerce platforms have been targeted for failing to provide a valid opt-out mechanism equivalent to a manual submission.

Ad tech companies and social media platforms have faced scrutiny for technical architectures that continue sharing data with downstream partners even after a consumer submits an opt-out request.

California residents who have attempted to opt out of the sale or sharing of their personal information and believe their request was ignored or undermined may have legal options.

If you submitted a CCPA opt-out request and continued to receive targeted advertising or encountered a process so defective it prevented you from exercising your rights, your experience may reflect a pattern of unlawful conduct affecting thousands of other California consumers.

Why Hire The Lyon Firm for CCPA and Data Privacy Cases

The Lyon Firm represents consumers in California and across the country in data privacy litigation, including cases involving CCPA opt-out failures and violations of data collection law.

If you are a California resident who believes your CCPA rights have been violated, or if you are located anywhere in the country and have concerns about how your personal data is being handled, contact The Lyon Firm today for a confidential case evaluation.