Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I sell personal information without obtaining consent in California? What are the requirements?

Based on the context documents provided, you cannot sell personal information without obtaining consent in California. The California Consumer Privacy Act (CCPA) and its regulations require businesses to obtain consumer consent before selling their personal information [1.1].

To obtain consumer consent, businesses must design and implement methods that incorporate the following principles:

  • Easy to understand language
  • Symmetry in choice
  • Avoid confusing language or interactive elements
  • Avoid choice architecture that impairs or interferes with the consumer’s ability to make a choice
  • Easy to execute methods [1.1]

If a business uses dark patterns to obtain consent from a consumer to sell their personal information, the agreement obtained through the use of dark patterns shall not constitute consumer consent [1.1].

Therefore, to sell personal information in California, businesses must obtain prior written voluntary consent of the individual to whom the information pertains, but only if that consent has been obtained not more than 30 days before the disclosure, or in the time limit agreed to by the individual in the written consent [2.2].

Additionally, businesses must comply with the Notice of Right to Opt-Out of Sale/Sharing and the “DO Not Sell or Share MY Personal Information” Link requirements [3.1]. The purpose of the Notice of Right to Opt-Out of Sale/Sharing is to inform consumers of their right to direct a business that sells or shares their personal information to stop selling or sharing their personal information and to provide them with the opportunity to exercise that right. The purpose of the “Do Not Sell or Share My Personal Information” link is to immediately effectuate the consumer’s right to opt-out of sale/sharing, or in the alternative, direct the consumer to the Notice of Right to Opt-out of Sale/Sharing [3.1].

Therefore, businesses must provide the Notice of Right to Opt-out of Sale/Sharing to consumers and include a conspicuous “Do Not Sell or Share My Personal Information” link that complies with section 7003, subsections (c) and (d) and is located at either the header or footer of the business’s internet homepage(s) [3.1].

In summary, businesses cannot sell personal information without obtaining consent in California. To obtain consent, businesses must comply with the CCPA and its regulations, including the Notice of Right to Opt-Out of Sale/Sharing and the “DO Not Sell or Share MY Personal Information” Link requirements.

Source(s):
Jurisdiction

California