Installation Appendix: Examples of guidelines that provide consumers with clear, accessible data control options

California: Consumer Privacy Rights Act (CPRA)

Under the CPRA, businesses that sell or share consumers' personal information must provide clear and accessible options for consumers to opt-out. Here are the key requirements:

• Opt-Out Link: A link titled "Do Not Sell or Share My Personal Information" must be prominently placed on the business's homepage. This link should direct consumers to a page where they can opt out of the sale or sharing of their personal information.
• Sensitive Information Link: Another link titled "Limit the Use of My Sensitive Personal Information" should be available. This link allows consumers to restrict the use or disclosure of their sensitive personal information.
• Single Privacy Link: Alternatively, businesses can use a single link, such as "Privacy Options," "Privacy Choices," or "Privacy Opt-Out Rights," which combines the functions of the above links. This link should be easily identifiable and allow consumers to opt out of sharing personal information and using sensitive personal information.

These links should blend seamlessly with the website's overall design and do not degrade the user experience. The California Attorney General has also provided a uniform opt-out icon to standardize these practices, which businesses are encouraged to use here.???LINK

Colorado: Data Privacy Act

Colorado's Data Privacy Act mandates that controllers (businesses that determine the purposes and means of processing personal data) provide clear opt-out methods for consumers regarding targeted advertising and the sale of personal data. The guidelines are as follows:

• Opt-Out Method: A conspicuous method must be provided for consumers to exercise their right to opt-out. This could be a link or any other clear method.
• Link Requirements: If a link is used, it should take consumers directly to the opt-out method. The link text should clearly indicate its purpose, using phrases like "Colorado Opt-Out Rights," "Personal Data Use Opt-Out," or "Your Privacy Choices." The opt-out method should be easily accessible and clearly stated in the privacy notice that consumers must receive.

Other States

While states like California and Colorado have specific requirements for opt-out mechanisms, other states, such as Connecticut, Oregon, Utah or Virginia, emphasize certain conditions that need to be met to facilitate consumer privacy:

• Opt-Out Link: if the information is processed for purposes of direct marking or advertisement, businesses are required to have a clear and conspicuous link on the controller's website that directs consumers or their agents to an internet page where they can opt out of targeted advertising or the sale of personal data.
• User-Friendly and Consistent: The opt-out method must be user-friendly and easy for the average consumer to use. It should also be consistent with similar platforms, technologies, or mechanisms other federal or state laws require.