CCPA Opt-Out Guide for Developers

Option 1: One Click Opt-Out Link

To create the One Click Opt-Out link:

1. Create a new template using the CCPA base template.

2. Create a Geolocation Rule

   Do Not Show

   Selectbanner.

   Opt-Out

   Select.

3. Generate script

4. Deploy script for One Click Opt-Out Link. In order for cookie blocking to work correctly, please see Do Not Sell for AdTech Vendors.

Option 2: Preference Center

There are two approaches for setting up a Preference Center. First, opting-out of all third-party ads and subgroups. Second, creating a custom CCPA template that only contains the Opt-Out of Sale group.

For detailed instructions on setting up a Preference Center consult: Customizing the Preference Center Template.

The following is an example of this preference center:

1. Create a new template using the CCPA base template.

2. Create a Geolocation Rule

   Do Not Show

   Selectbanner.

   Opt-Out

   Select.

3. Generate script

Option 3: Widget Layout (Combined Web Form and AdTech Opt-Out)

Add a category for Opt-out of web form. To do this, go to the Categorizations screen and the Categories tab. Then, click Add New and create a category with the name you want to use. For more information, see Managing and Categorizing Cookies and SDKs.

In order to have this category appear, you will need to add a dummy cookie to the group. This cookie will not be displayed. On the Categorizations screen, go to the Cookies tab. Click Add Cookie. Complete the fields and assign it to the site where you would like to use the widget as well as to the group for web form opt-out.

1. Create a new template using the CCPA base template.

2. Create a Geolocation Rule

   1. Select Do Not Show banner.

   2. Select Opt-Out.

3. Generate script

Explanation of Service Provider Addendum

When opting out of the sale, you really only need to block the technology that is transferring PI as part of a "Sale" under CCPA. This may not include all third-party trackers. There are several exemptions to the "Sale" of data. One of the broadest in scope is "sharing information for a business purpose". It applies wherever information is used or shared with a service provider for a "business purpose", which is defined as "a business’s or a service provider’s operational purposes, or other notified purposes".  

Several requirements need to be met for this exception to apply:

• the transfer must be necessary to perform a task that has a “business purpose”;

• the transfer must take place “pursuant to a written contract” that prohibits the service provider from “selling, retaining, using, or disclosing the personal information”;

• the business has provided compliant notice to consumers of the fact that it intends to share with service providers; and

• the service provider does not further “collect, sell, or use” the personal information of the consumer except as necessary to perform the “business purpose.”

What this means for developers

If your legal team has identified and put in place (contractually) service provider agreements with vendors of the tracking technology on your site, then these may not need to be blocked. Discussing this with your team, and identifying where you may be leveraging service providers are good first steps.

Local Tag and Direct Tracker Blocking

The easiest ways to configure the technologies on your site are to use a tag manager or client-side code to manage your site.

For more information, see: Cookie Consent Integration with Google Tag Manager and Client-Side Cookie Management.

Subject Types & Request Types

Consider which California consumers your organization interacts with and how their data is collected and processed. This evaluation will help determine the appropriate Subject Types that should be listed on your web form.

Request Type customization can vary. A single-select Do Not Sell My Personal Information field is acceptable for some organizations, while some may choose to offer an opt-down method by giving the consumer the choice to opt out of specific (or all) services offered.

The opt-down method requires you to enable the Hide from Web Form setting to omit the Request Type field from the web form, which needs a default value to automatically populate in the form. A second form field must also be added with value options that correspond with the services from which the consumer will choose to opt-out of sale.

For more information, see Creating a Web Form and Customizing a Web Form.

Identifiable Fields

The remaining form fields should be configured with respect to the types of personally identifiable information (PII) required by your organization for record processing. Determine which contacts methods will be used to initiate and track consumer requests or if a specific user or account ID is required to align with the subject and request type.

For more information, see Customizing a Web Form.

Publishing the Web Form

Once your CCPA web form is successfully configured, you can provide consumers access to the form on your website. Save and publish the web form, then determine if it should be placed behind a URL link, a button selection, or in an iframe.

For more information on deploying web forms on your site, see Adding your Web Form to an Existing Website.

Generating Web Form Links

First, you will need to configure and publish a web form. For more information, see: Web Form Configuration.

1. Generate the web form link.

   
   
   

2. Copy the generated link and paste it into your Privacy Page HTML template.