Opt Out

Opt-out is the baseline consent model under most US state privacy laws (CCPA/CPRA, Virginia CDPA, Colorado CPA and the growing patchwork). The business may process personal information for its disclosed commercial purposes unless the consumer exercises a right to opt out of the sale or sharing of their personal information, out of targeted advertising, or — for CPRA — out of use of sensitive personal information beyond disclosed necessary purposes.

Opt-out signals matter here. Global Privacy Control (GPC) and the Global Privacy Platform (GPP) framework let a browser or app send an automated opt-out signal that businesses must honour under CCPA/CPRA and several other state laws. Under GDPR, DPDP and PDPA, opt-out is not sufficient as a lawful basis for most processing — the standard is opt-in — but opt-out mechanisms (unsubscribe, consent withdrawal) are still required to make opt-in consents revocable.