Do Not Sell Banner for US State Laws: Implementation & Verification Guide

Introduction

*Updated for 2026 compliance practices.*

If you operate a website that serves visitors from California, Virginia, Colorado, Connecticut, Utah, or other states with comprehensive privacy laws, you’ve likely encountered the requirement to provide a “Do Not Sell or Share My Personal Information” link or banner. This guide explains what a **do not sell banner for US state laws** means in practice, how to implement it correctly, and how to verify your setup using GDPRChecker’s scanning tools. We focus on technical implementation and verification—not legal advice—so you can close compliance gaps efficiently.

**Important note on GDPRChecker’s role**: GDPRChecker is a scanning and verification tool for public websites. It does not provide the banner itself or act as a full consent management platform (CMP). Instead, it helps you confirm that your chosen banner solution is correctly implemented and functioning as required by law.

What Is a Do Not Sell Banner for US State Laws?

A **do not sell banner for US state laws** is a website disclosure that gives consumers a clear, conspicuous way to opt out of the sale or sharing of their personal information. Under laws like the California Consumer Privacy Act (CCPA), as amended by the CPRA, and similar statutes in other states, businesses must honor opt-out requests and provide a mechanism—often a link or interactive banner—that says “Do Not Sell or Share My Personal Information.”

From a technical standpoint, this banner is not just a static notice. It must trigger a functional opt-out that stops the flow of personal data to third parties for monetary or other valuable consideration. This typically involves integrating with your consent management platform (CMP) or tag management system to suppress tracking scripts, cookies, and pixels when a user exercises their choice.

Key characteristics of a compliant banner include: - **Visibility**: It should be easy to find, often in the footer or via a persistent icon. - **Clarity**: Language must be plain and unambiguous. - **Functionality**: It must actually prevent data sales/shares, not just display a message. - **Persistence**: The opt-out choice should be remembered for at least 12 months or until the user changes it.

Do Not Sell Banner Requirements and Compliance Expectations

US state privacy laws share common themes but differ in specifics. Here’s what you need to know for the major frameworks:

California (CCPA/CPRA) - Requires a “Do Not Sell or Share My Personal Information” link on the homepage and in the privacy policy. - The opt-out mechanism must be easy to execute and not require account creation. - Businesses must wait at least 12 months before asking consumers to opt back in. - The Global Privacy Control (GPC) signal must be honored as a valid opt-out.

Virginia (VCDPA) - Consumers have the right to opt out of targeted advertising, sale of personal data, and profiling. - The opt-out request must be effectuated without undue delay, not later than 15 days.

Colorado (CPA) - Similar opt-out rights for targeted advertising and sale of personal data. - Requires a universal opt-out mechanism (UOOM) to be recognized by July 2024.

Connecticut (CTDPA), Utah (UCPA), and others - Each has its own effective dates and nuances, but the core requirement is a clear opt-out mechanism for sales or targeted advertising.

**Common expectation**: Your banner must not only exist but also be technically integrated to stop data flows. Regulators look for evidence that opt-outs are respected, not just promised.

How to Implement a Do Not Sell Banner Step by Step

Implementing a **do not sell banner for US state laws** involves both design and technical configuration. Follow these steps:

Step 1: Choose a Consent Management Platform (CMP) Select a CMP that supports US privacy signals and can manage opt-out preferences. While GDPRChecker is not a CMP itself, it can scan and verify the behavior of your chosen CMP. Look for a CMP that: - Detects user location and applies the correct legal framework. - Supports GPC signals. - Provides a customizable banner or link.

Step 2: Configure the Banner or Link Design the banner to appear as a footer link, a floating button, or a modal. The CCPA requires the link to read “Do Not Sell or Share My Personal Information” or similar. Ensure it’s visible on every page.

Step 3: Map Opt-Out to Tag Management Integrate the opt-out toggle with your tag manager (e.g., Google Tag Manager). When a user opts out, the CMP should fire a signal that suppresses tags for advertising, analytics, and social media pixels that constitute a “sale” or “share.”

**Example**: In Google Tag Manager, set up a trigger that listens for a CMP custom event (e.g., `us_privacy=1YNN`) and blocks tags accordingly.

Step 4: Implement GPC Support Ensure your banner or CMP listens for the Global Privacy Control signal. If a browser sends `Sec-GPC: 1`, treat it as an opt-out without requiring additional user action.

Step 5: Test Pre-Consent Behavior Before a user interacts with the banner, no personal information should be sold or shared. Use GDPRChecker to scan your site and verify that no third-party requests containing personal data fire before consent.

Step 6: Document and Monitor Keep records of your configuration and regularly scan for changes. Laws evolve, and new trackers can appear unexpectedly.

Common Mistakes and How to Avoid Them

Even well-intentioned implementations fail. Here are frequent pitfalls:

**Banner without backend enforcement**: Displaying a “Do Not Sell” link that doesn’t actually stop data flows. **Fix**: Verify with GDPRChecker that opt-out toggles suppress third-party requests.
**Ignoring GPC signals**: Not honoring browser-based opt-out preferences. **Fix**: Test with a browser that sends GPC and confirm via scanner that tags are blocked.
**Re-requesting consent too soon**: Asking users to opt back in before 12 months. **Fix**: Configure your CMP to respect the opt-out duration.
**Inconsistent behavior across pages**: The banner works on the homepage but not on subpages. **Fix**: Use GDPRChecker’s page-coverage checks to scan multiple URLs.
**Misclassifying essential vs. non-essential data flows**: Some analytics may be considered a “sale” under CCPA if they involve third-party ad networks. **Fix**: Audit your tag inventory and classify each tracker.

How to Validate Your Do Not Sell Banner with GDPRChecker

GDPRChecker provides a scanner that verifies your **do not sell banner for US state laws** implementation without manual testing. Here’s how:

**Pre-consent scan**: Run a scan before any user interaction. GDPRChecker will list all network requests and flag those that may constitute a sale or share.
**Opt-out simulation**: Use the scanner’s ability to mimic an opt-out choice (if supported by your CMP) and confirm that tracking scripts are suppressed.
**GPC verification**: The scanner can detect whether your site responds to the GPC signal by checking for suppressed requests.
**Banner presence check**: GDPRChecker confirms that the “Do Not Sell” link or banner is present and accessible on scanned pages.
**Post-change monitoring**: After updating your CMP or tags, rescan to ensure no regressions.

For advanced needs, GDPRChecker’s paid plans offer runtime protection, consent records, and tracker inventory management, giving you ongoing evidence of compliance.

Real-World Examples of Do Not Sell Banner Implementations

Example 1: E-commerce Site with Multiple Ad Pixels An online retailer uses Facebook Pixel, Google Ads, and a retargeting service. Their CMP displays a “Do Not Sell” link in the footer. When a California user clicks it, the CMP sets a first-party cookie indicating opt-out, and Google Tag Manager blocks all three pixels. GDPRChecker scan confirms zero ad requests post-opt-out.

Example 2: News Publisher with GPC Support A news site implements GPC listening. A visitor with GPC enabled never sees a banner because the opt-out is automatic. The site’s analytics (configured as a “sale”) are suppressed. GDPRChecker detects the GPC signal and verifies no analytics calls.

Example 3: SaaS Company with Multi-State Compliance A B2B SaaS platform serves users nationwide. Their CMP detects the user’s state via IP geolocation and shows the appropriate banner: “Do Not Sell” for Californians, “Opt-out of Targeted Advertising” for Virginians. GDPRChecker’s multi-page scan ensures consistency across the marketing site and app dashboard.

Implementation Checklist

Use this checklist to ensure your **do not sell banner for US state laws** is correctly deployed:

Identify all third-party tags that may constitute a “sale” or “share” of personal information.
Choose a CMP that supports US opt-out mechanisms and GPC.
Design and place a clear “Do Not Sell or Share My Personal Information” link on every page.
Configure the CMP to fire an opt-out signal to your tag manager.
Set up tag manager triggers to block relevant tags on opt-out.
Implement GPC detection and automatic opt-out.
Test pre-consent behavior: no sale/share tags should fire before user choice.
Test opt-out behavior: all sale/share tags must be suppressed after opt-out.
Verify persistence: the opt-out should survive page reloads and return visits.
Scan multiple pages with GDPRChecker to confirm consistent behavior.
Document your configuration and scan results for accountability.
Schedule regular rescans (e.g., monthly) and after any tag or CMP changes.

For a deeper dive into related topics, see our guides on cookie banner requirements and how to add a cookie banner to your website. If you’re using Google services, understanding Consent Mode v2 vs Google Certified CMP is essential.

FAQ

What is a do not sell banner for US state laws? It’s a website notice that allows consumers to opt out of the sale or sharing of their personal information, as required by laws like the CCPA. It must be functional, not just a static message, and should stop data flows to third parties when activated.

Do I need a do not sell banner for US state laws for GDPR? No. GDPR requires opt-in consent for cookies and data processing, not an opt-out banner for sales. However, if you serve both EU and US users, you may need both a cookie consent banner and a do-not-sell mechanism. See our guide on do I need a CMP if I do not run Google Ads.

How do I implement a do not sell banner for US state laws? Choose a CMP that supports US privacy laws, configure a visible opt-out link, integrate it with your tag manager to block sale/share tags, and support GPC signals. Test thoroughly with a scanner like GDPRChecker.

How can I verify my do not sell banner with a scanner? Use GDPRChecker to scan your site before and after opt-out. It checks for unauthorized network requests, banner presence, and GPC handling. This provides evidence that your implementation works as intended.

What are common do not sell banner mistakes? Common errors include displaying a banner without backend enforcement, ignoring GPC signals, inconsistent behavior across pages, and misclassifying data flows. Regular scanning helps catch these issues.

Which cookies and trackers should I check for do not sell compliance? Focus on advertising pixels, social media trackers, and analytics services that share data with third parties for non-essential purposes. Even some first-party analytics can be considered a “sale” if they feed ad networks.

How often should I review my do not sell banner setup? Review at least monthly and after any changes to your tags, CMP, or privacy policy. Laws and technology evolve, so continuous monitoring is recommended. GDPRChecker’s scheduled scans can automate this.

What evidence should I keep for do not sell banner compliance? Maintain records of your CMP configuration, scan reports showing pre- and post-opt-out behavior, documentation of GPC support, and logs of user opt-out choices (if available). This demonstrates accountability to regulators.

To avoid common pitfalls, review our article on common cookie banner mistakes and cookie banner best practices.

Ready to verify your setup? Run a free scan with GDPRChecker now to see if your **do not sell banner for US state laws** is truly protecting user choices.

Next step

Run a GDPRChecker scan to validate consent behavior, trackers, and disclosures after you implement the checklist above.

Article schema

```json { "@context": "https://schema.org", "@type": "Article", "headline": "Do Not Sell Banner for US State Laws: A Practical Compliance Guide for Website Owners", "description": "Learn what a do not sell banner for US state laws means, how to implement it step-by-step, avoid common mistakes, and verify compliance with GDPRChecker's scanner.", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.gdprchecker.online/guides/do-not-sell-banner-for-us-state-laws" }, "publisher": { "@type": "Organization", "name": "GDPRChecker", "url": "https://www.gdprchecker.online" } } ```

Copyright and editorial notice

This original AI-assisted editorial draft was selected, reviewed, and published by GDPRChecker. All rights are reserved where protected by applicable law. Do not reproduce the article without permission.