Under the original CCPA, consumers had the right to opt out of the 'sale' of their personal information, broadly defined to include exchanging data for monetary or other valuable consideration. The CPRA extended this to include 'sharing', defined to cover disclosing personal information to third parties for cross-context behavioral advertising, regardless of whether money changes hands.
This distinction matters significantly for digital advertising. Many data flows that power programmatic advertising, retargeting, and audience-building don't involve direct payment for data, but the CPRA's 'sharing' definition captures them anyway. Businesses displaying targeted ads must honor Do Not Share signals in addition to Do Not Sell.
Operationally, honoring these rights requires suppressing opted-out identifiers across every downstream system that receives data for advertising purposes, not just at the collection point. Businesses must also provide a clear 'Do Not Sell or Share My Personal Information' link, honor opt-out requests within 15 business days, and recognize the Global Privacy Control (GPC) signal as a valid opt-out mechanism.