Opt-Out
A consent model where data processing begins by default and users must actively refuse or withdraw to stop it.
Opt-out is a consent model where data processing or cookie placement occurs by default, and individuals must take action to refuse or stop the processing. This model is the basis of the CCPA and CPRA, where businesses can collect and use personal information but must provide a clear mechanism for consumers to opt out of the sale or sharing of their data, typically via a prominent "Do Not Sell or Share My Personal Information" link.
The opt-out model is fundamentally different from opt-in and is less restrictive for businesses. Under the CCPA, businesses must honor opt-out requests, apply them within 15 business days, and not ask consumers to re-consent for at least 12 months. The opt-out model also interacts with the Global Privacy Control (GPC) browser signal, which the CCPA requires businesses to treat as a valid opt-out request. While simpler to implement than opt-in, the opt-out model still requires clear disclosures, accessible opt-out mechanisms, and reliable technical enforcement.