State privacy laws give you the right to opt out of businesses selling your personal data and using it for targeted advertising. These opt-out rights let you stop companies from profiting off your information and prevent the personalized ads that follow you across the internet. Understanding how to exercise these rights effectively puts you in control of how your data is used.
Understanding Data Sales
The sale of personal data means exchanging your information for money or other valuable consideration. When businesses sell your data, they transfer it to third parties who use it for their own purposes—often marketing, advertising, or reselling to others. Data brokers specialize in buying and selling consumer information, creating detailed profiles used for advertising targeting.
What counts as a sale varies by state law. California defines it broadly to include sharing data for monetary or other valuable consideration. Virginia and other states focus on monetary exchanges. Understanding the definition in your state helps you know what activities your opt-out stops.
Data sharing with service providers who process information on the business behalf is typically not considered a sale. When a business uses a payment processor or email service, that sharing serves the business purposes rather than the third party independent interests.
Understanding Targeted Advertising
Targeted advertising uses personal data collected about your activities across different websites, apps, and services to show you personalized ads. When you search for shoes on one site and then see shoe ads everywhere you browse, that is targeted advertising in action.
Cross-context behavioral advertising relies on tracking your behavior across multiple unaffiliated websites and services. First-party advertising—where a business shows you ads based only on your interactions with that specific business—is typically not covered by opt-out rights.
The infrastructure behind targeted advertising involves complex networks of data sharing. Your browsing data, purchase history, location data, and other information flows between advertisers, ad networks, data brokers, and publishers. Opting out stops businesses from feeding your data into this system.
States with Opt-Out Rights
California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states provide opt-out rights for data sales and targeted advertising. If you live in one of these states, you can exercise these rights against any business covered by the applicable law.
Coverage varies by state. California covers the largest businesses by revenue or data volume. Other states use consumer number thresholds. Some businesses may be covered in California but not in states with different requirements.
Even if you live in a state without a comprehensive privacy law, some businesses extend opt-out rights to all users. Major companies often find it easier to provide consistent privacy controls rather than different systems for different states.
How to Opt Out
Look for opt-out links on business websites. California law requires a Do Not Sell or Share My Personal Information link on websites and apps. Other states may require similar disclosures. These links lead to opt-out mechanisms or instructions.
Check privacy settings in apps and accounts. Many services include privacy controls that let you disable data sharing and personalized advertising. Look in settings menus for privacy, advertising, or data sharing options.
Submit opt-out requests through the methods businesses provide. Some use online forms, others provide email addresses or phone numbers. Provide enough information for the business to identify your data and process your request.
Universal Opt-Out Mechanisms
Universal opt-out mechanisms let you send opt-out signals to every website you visit automatically. Rather than submitting individual requests to hundreds of businesses, you configure your browser or device once and the opt-out signal goes everywhere.
Global Privacy Control (GPC) is the leading universal opt-out standard. When enabled in your browser or through browser extensions, GPC sends a signal to every website indicating you want to opt out of data sales and sharing. California, Colorado, and Texas require businesses to honor GPC signals.
To enable GPC, use a browser that supports it natively (like Firefox, Brave, or DuckDuckGo) or install a browser extension that adds GPC support. Once enabled, the signal is sent automatically to every website without requiring any additional action from you.
Opting Out of Data Broker Sales
Data brokers present special challenges because you typically have no direct relationship with them. They collect information about you from various sources and sell it without your knowledge. Opting out requires identifying brokers who have your data and submitting individual requests.
Some states maintain data broker registries. California and Vermont require data brokers to register, making it easier to identify companies that may have your information. Check these registries to find brokers to contact.
Services exist that submit opt-out requests to data brokers on your behalf. These authorized agents can streamline the process of contacting many brokers. Some are free; others charge subscription fees for ongoing monitoring and repeated opt-outs.
What Happens After You Opt Out
Businesses must stop selling your data and using it for targeted advertising after processing your opt-out. They should confirm your request and update their systems. The timeframe for implementation varies but is typically within 15 to 45 days.
You may still see advertisements after opting out, but they will not be targeted based on your cross-site behavior. Contextual ads based on the content you are viewing, geographic targeting based on general location, and first-party ads based on your interactions with that specific business may continue.
Opt-out requests generally apply only to future data use. Data already shared before your opt-out may remain with third parties. However, businesses should not sell additional data about you going forward.
Businesses That Do Not Honor Opt-Outs
If a business fails to honor your opt-out request, document the violation. Keep records of your request, any confirmation received, and evidence that data sales or targeted advertising continued.
File complaints with your state Attorney General. Most state privacy laws are enforced by the Attorney General rather than through private lawsuits. Your complaint may prompt investigation and enforcement action.
Consider using the appeal process if available. Most state laws require businesses to provide an appeal mechanism for denied or ignored requests. Appeals must receive a response within specified timeframes.
Limitations of Opt-Out Rights
Opting out stops future sales and targeted advertising but does not delete data already collected. To remove existing data, you need to exercise separate deletion rights.
Opt-outs are typically business-specific. Opting out with one company does not affect others. You may need to submit many opt-out requests to comprehensively limit data sales across the businesses that have your information.
Some data sharing falls outside opt-out rights. Sharing with service providers, sharing required by law, and sharing you specifically directed all continue regardless of opt-out status. The opt-out applies to sales and targeted advertising, not all data transfers.
Conclusion
Opting out of data sales and targeted advertising is one of the most impactful privacy rights available under state law. By using individual opt-outs, universal opt-out mechanisms like Global Privacy Control, and data broker opt-out services, you can significantly reduce how businesses profit from and use your personal information. While limitations exist, these rights provide meaningful control over the data economy built around your personal information.