06 Aug 2025 Search

California Privacy Protection Agency, in LOCKED Series: Right to Limit & Opt-Out:

If you are on a business’s website and you can’t find the links to exercise your rights, remember to check their privacy policy. The privacy policy should tell you how you can exercise your rights under the law.

No way, that’s CPPA’s job. That’s what I pay taxes for. Individual Californians need to read privacy policies like restaurant diners need to read food safety manuals and microbiology textbooks. Privacy Labor is a thing, and one of the main points of having privacy laws, and privacy agencies, is to let people do as little of it as possible. (I keep my list of effective privacy tips short, partly because I resent having to have such a list at all. Each item on the list represents a failure or missing feature of some software or laws. The work of coming into compliance with a norm should be done by the transgressor of the norm, not by others who are affected.)

There are five (?) reasons that you would not see a do not sell or share my personal information link on a page.

  1. You are on a page that is not required to have the link. According to the law, the link only has to be on the company’s internet homepages.

  2. The site is not owned by a business that is required by CCPA/CPRA to have the link. The company might be too small, and have data on too few people, to be covered.

  3. The business does not actually sell or share personal information. This is something that, technically, you could find in the privacy policy, but realistically most companies (even Mozilla) still participate in the surveillance economy. If a company was really never selling or sharing your personal information, they would have bragged about it and you would have heard about it.

  4. You are runnning some kind of ad blocker, privacy tool, or JavaScript blocker that keeps the link from showing up. (On some sites, the main page content comes from the CMS but the link is added by JavaScript or a service provider.)

  5. The site is breaking the law.

So if you don’t see the link, do not go read the privacy policy. Privacy policies, at best, are lists of all the creepy stuff that the site’s lawyer’s other clients got caught doing. And often they’re just some boilerplate that came with the CMS and that the site owner hasn’t looked at in a while. You’re unlikely to get anything useful out of reading one. (If they did put some malarkey about how you can exercise your rights under the law in there without actually, you know, obeying the law, it’s even less worth reading.)

Instead, if the site is owned by a company big enough to be covered by CCPA/CPRA:

  1. If you were using an ad blocker, temporarily turn it off.

  2. Look on the home page of the site.

  3. If you still can’t see the link, go ahead and submit CPPA’s Complaint Form

If you’re reading a privacy policy, you’re probably doing something wrong. (Or you’re a nerd. Hopefully a privacy nerd trying to trying to apply nerd skills to make things better and not worse.) More: Privacy tips with no brand names and no links