§1798.120 Right to Opt Out of Sale or Sharing of Personal Information
Consumers have the right, at any time, to direct a business that sells or shares PI about the consumer to third parties to stop selling or sharing the consumer's PI. Businesses that sell or share PI of consumers under 16
4
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Age verification and opt-in records for minors · Document repository
- Sale/share suppression list and propagation evidence · Document repository
governing documentDocuments that govern the control
- Do Not Sell or Share My Personal Information mechanism · Document repository
- 12-month re-solicitation cooldown tracking · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Opt-out not honored for adtech cookies
- Minors opt-in defaulted to adult workflow
- Re-solicitation occurs inside 12 months
- Suppression list not synced to ad partners
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet§1798.115 Right to Know Personal Information Sold or Shared and Recipients · §1798.121 Right to Limit Use and Disclosure of Sensitive Personal Information