What evidence do auditors commonly ask for on 1798.120 Honour the right to opt out of sale or sharing?

Opt-out preference store and the integrations that read it before any sale or sharing; Inventory of data flows that count as selling or sharing, including advertising pixels and SDKs; Due diligence checklist for acquired data sets carrying over opt-out status.

What is the most common gap auditors find on 1798.120?

Advertising tags still firing for opted-out users

CCPA/CPRA · Opt-out of sale or sharing, limiting sensitive data and preference signals

`1798.120` Honour the right to opt out of sale or sharing

Consumers may at any time direct a business selling or sharing their data to stop. The business must give notice that it may sell or share data and that this right exists, and after receiving the direction must not sell or share that consumer's data unless the consumer later consents. A business that acquires data in a merger, acquisition or similar transaction must respect directions given to the seller.

Source: CCPA/CPRA, 1798.120. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Opt-out preference store and the integrations that read it before any sale or sharing · Document repository
Inventory of data flows that count as selling or sharing, including advertising pixels and SDKs · Policy repository / GRC workspace
Due diligence checklist for acquired data sets carrying over opt-out status · Vendor register / contract repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Advertising tags still firing for opted-out users
Opt-out status lost when data moves to a new system or acquirer

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

1798.115(b) Disclose sales, sharing and business-purpose disclosures on request · 1798.120(c) Obtain opt-in before selling or sharing data of consumers under 16