The Digital Advertising Alliance has published guidance on the use of a tool for opt out requests under CCPA under its (voluntary) self-regulatory principles.

Takeaways:

• Both the entity that owns and operates the digital property and collects Personal Information directly from a consumer (publisher) and a third party that indirectly collects Personal Information through the publisher’s digital property (third party) are required to honor California “Do Not Sell” requests.

Third Parties:

• When a consumer exercises their California “Do Not Sell” rights through the CCPA Opt-Out Tool, third parties may use and transfer such Personal Information only for certain operations and system management purposes.

Publishers:

• Must display a California “Do Not Sell My Personal Information” link leading to a notice that describes the third party collection of personal information and links to the DAA CCPA Opt-out Tool.
• Must place a flag that can be read by third parties indicating the link(s) have been placed; and
• If a publisher collects Personal Information and transfers it to a third party, it must provide a “Do Not Sell” choice. and inform parties with whom is shared information in the past 90 days of such consumer choice.

Details from the Digital Advertising Alliance.

[View source.]