Skip to content 
The integration of the Do Not Sell My Info Page on a WordPress website is a central component of legally compliant data protection measures - especially in the context of CCPA and in addition to the GDPR. To ensure that user rights such as opt-out and data management are implemented correctly from a technical perspective, both structural and content-related requirements must be met.
Key points
- CCPA: US data protection law requires opt-out and an easily accessible info page
- DSGVODuty to inform and transparent data processing
- Technical implementationPlugins or manual templates for page integration
- Mandatory content: Clear information on data sales and simple option to object
- Legal conformityCombination of several legal requirements on one website
As different data protection regulations apply in an international context, it is necessary to deal with data protection laws during the planning or ongoing operation of the website. Those who mainly operate in the EU tend to focus primarily on the GDPR. However, it is often overlooked that the CCPA, which applies in California, imposes additional requirements. A "Do Not Sell My Info Page" should be available, especially if visitors from the USA access the website, as otherwise fines may be imposed. This page also serves as a signal to visitors that their data rights are being taken seriously.
Why a "Do Not Sell My Info Page" is necessary
The Californian data protection law CCPA obliges website operators to provide further information about the sale of personal data. The so-called Do Not Sell My Info Page is a mandatory element. It allows visitors to actively object to the sharing of their information. Even if your website is primarily operated in the EU, it may be accessible to US users - which also makes the CCPA regulations relevant. It is therefore important to customize your WordPress site to comply with international regulations.
In addition, a Do Not Sell My Info Page not only increases legal certainty, but also creates transparency. Visitors recognize that they are offered several data protection options. Transparency is an important asset, especially from a marketing perspective, as users are more likely to trust pages that clearly and visibly list all relevant data protection elements. If, on the other hand, the option to object to the transfer of data is hidden or presented in a complicated manner, this can lead to a loss of trust. The active integration of this page is therefore part of a professional online presence.
Legal basis: GDPR, CCPA and PDPL at a glance
It's no secret: data protection laws have a wide variety of requirements. While the DSGVO Europe-wide comprehensive information and consent requirements, the CCPA in California explicitly includes an opt-out option and special visitor rights. In addition, the new PDPL Directive in Germanywhich is aimed at data sovereign processing. If you operate digital services worldwide or reach users from different jurisdictions, you need to be aware of these differences - and map them correctly on your WordPress site.
Companies that have branches in California or process data of Californian users, for example, are subject to the provisions of the CCPA. According to this law, visitors must be able to easily exercise their data protection rights. This includes the right to:
- to find out exactly what data is being collected,
- to know whether and how these are passed on, and
- to refuse this disclosure (opt-out).
Although a similar right to control personal data also exists in the GDPR, consent is often the central mechanism there. The German PDPL (Privacy and Data Processing Law) and other national laws also supplement this legal framework. It is therefore important to carefully analyze which users you are targeting and in which regions the requirements are particularly strict.
Technical implementation in WordPress
You have two options for implementing the Do Not Sell My Info Page: integration via a plugin or by creating a static info page including a form. Plugins such as "Complianz" or "CookieYes" simplify the process with preconfigured modules. Alternatively, you can create a separate page via the WordPress editor, which you can make visible in the footer or via a clearly visible link. Make sure that the element is set to each underside is accessible - especially via mobile devices.
The responsive design is particularly relevant: On smartphones or tablets, users must be able to find the Do Not Sell My Info Page and go through the opt-out process without much effort. It is also a good idea to link this page in the cookie banner or integrate it in the immediate vicinity of the privacy policy. Some website operators integrate a short summary of the most important data protection rights directly into the banner or as a pop-up that appears on the first visit. A further link then refers to the complete Do Not Sell My Info Page.
From a technical perspective, automation is particularly interesting: if you receive a request via the opt-out form, this can be forwarded directly to your GDPR/CCPA management system, for example. There you can track which user has objected and when, and which data may be deleted or not passed on. However, such a solution requires programmatic interfaces (APIs) in some cases and should be stable against updates and plugin conflicts.
What belongs on a Do Not Sell My Info Page
The content of the page must be specific and clearly understandable. In addition to an introductory text, this includes the following elements:
- Transparent descriptionwhich data is collected
- Explanationhow they might be passed on or sold
- Opt-out form or clear reference to a function for self-disclosure
- Contact possibility for queries regarding data processing
Don't forget to put the target group in the foreground. A user visiting your site ideally wants to understand how you handle data with just a few clicks. Complex legal formulations should - wherever possible - be translated into generally understandable language. Graphical delimitation (e.g. using icons, colored boxes or paragraphs) can also help to make the page clearer. Anyone using templates should definitely have their compliance checked by a lawyer to ensure that all relevant passages are covered.
Differences between GDPR and CCPA
Although both laws pursue similar objectives - namely the protection of personal data - their requirements differ in detail. While the DSGVO focused on consent, the CCPA processing by default until a user actively objects. This mechanism not only requires different processes, but also a completely different structure of the data protection page.
| Feature | GDPR (EU) | CCPA (California) |
|---|---|---|
| Consent required | Yes | No (opt-out sufficient) |
| Do Not Sell page required | No | Yes |
| Fines for violations | Up to € 20 million or 4 % of turnover | Up to USD 7,500 per violation |
| US users affected? | No | Yes |
In practice, this difference often causes confusion for website operators. Anyone who has already established a GDPR-compliant consent solution should not assume that this is automatically sufficient for the CCPA requirements. After all, the Californian legislator is still concerned about opt-out mechanisms, which must already be activated by default. This separation between "permission only after consent" (GDPR) and "permitted until objection is made" (CCPA) is one of the most fundamental differences. A concept that ensures both requirements at the same time must therefore provide an opt-in function for European users and an opt-out function for Californian users.
Linking the data protection page
It is not enough to simply create the page. It must also be placed strategically: in the footer, in the cookie banner or directly in the header. This improves user-friendliness and at the same time ensures that the legal framework is adhered to. Particularly effective is a Permanently integrated footer linkwhich remains visible on mobile devices as well as on the desktop.
Many website operators also integrate the link to the Do Not Sell My Info Page into their main privacy policy. For example, you can refer directly to the opt-out option in the body text of the privacy policy. This ensures that users who read through the privacy policy do not have to search laboriously in the navigation menu. Link duplication - both in the footer and in the privacy policy - increases the likelihood that visitors will notice and use the opt-out option. Another approach is to temporarily place the page in a prominent banner as soon as relevant changes have been made. This way, existing users are actively informed about changes and can react immediately if necessary.
Recommended page structure for data protection on WordPress
An unencumbered navigation and clear page titles create trust and fulfill legal criteria. I recommend the following page structure:
1. privacy policy: Classic main text incl. hosting, plug-ins and third-party providers.
2. cookie policy: Detailing the technologies used.
3. contact the data protection officer: Easy to find.
4 Do Not Sell My Info Page: Clear, mobile-optimized and actively linked.
This structure reflects current requirements. You can supplement it with an additional note in the cookie banner or via a modal window that is integrated as a layer. Even if this structure initially seems extensive, you will benefit in the long term from clear responsibilities and a comprehensible navigation structure. Users who search specifically for the data processing processes will find the relevant passages more quickly. At the same time, the design is not overly complicated if you consistently rely on the division into subpages.
Common mistakes and how to avoid them
Many websites only implement the requirements incompletely. Common errors include a lack of opt-out options, overly technical language or non-functioning forms. Check your installation regularly - especially after WordPress updates. Test your pages with VPNs from different countries in order to correctly assess the display for Californian and European users.
Many people also underestimate the importance of documentation. In the event of a data protection audit by the authorities, you should be able to prove when and how changes were made to the Do Not Sell My Info Page. For example, if you change a plugin or make adjustments to the form, make a note of this in a change log. Should a complaint arise, you will quickly have verifiable arguments at hand thanks to this complete documentation. It also makes sense to randomly check at least once a quarter whether the opt-out function is working correctly. Sometimes plugin conflicts or JavaScript errors can lead to a user submitting the form unnoticed, but the request is not recorded correctly in the system.
Another common mistake is to ignore special national regulations other than the GDPR and the CCPA. Although these two laws take center stage, individual EU member states or other US states may have different - or supplementary - provisions. Close coordination with a data protection officer who is familiar with the relevant regions is therefore advisable.
Extended data protection guidelines for your website help to avoid such errors in the long term.
Forms and user-friendliness
A user-friendly opt-out form is mandatory. Use simple questions with checkboxes instead of long text fields. Offer a confirmation message as soon as the form has been sent. Synchronization with a consent management tool is ideal - for example via an API-enabled plugin. As soon as data is collected, it must be stored in a data protection-friendly manner and deleted if necessary - depending on the requirements.
User-friendliness is also reflected in the design of the confirmation processes. For example, it is advisable to send an email confirmation to the user so that they know that their objection has been received and is being processed. Some companies use a double opt-out procedure for this purpose, in which a user confirms their withdrawal again in an email they receive. Although this is not a must, it can help to reduce misuse or incorrect entries in certain scenarios. In turn, this can increase the credibility and traceability of all data protection communication.
Recommended plugins for data protection pages
WordPress allows a variety of plugins for data protection implementation. These usually also offer support for the integration of a Do Not Sell My Info Page:
- CookieYes (CCPA + GDPR compliance)
- Compliance (intuitive operation, configurable legal system)
- GDPR Cookie Consent from WebToffee
Make sure that the plugin is updated regularly - and separates GDPR and CCPA-specific functions in the backend. Many providers are constantly implementing new functions in order to react to changes in the legal situation. This minimizes the risk of having integrated outdated or incorrect processes. It can also be useful to use a staging system to test plugin updates and their impact on the Do Not Sell My Info Page before they go live.
Practical implementation: sample structure and sample text
Here is a basic HTML structure for your Do Not Sell My Info Page:
<h2>Object to the sale of my data</h2>
<p>Under the California Consumer Privacy Act (CCPA), you have the right to object to the sale of your personal information.</p>
<form action="">
<label>Your e-mail address:</label><br />
<input type="email" name="email" required /><br /><br />
<input type="checkbox" name="optout" required />
I object to the sale of my personal data.<br /><br />
<button type="submit">Sending</button>
<input type="hidden" name="trp-form-language" value="en"/></form>
This section can be integrated with Contact Form 7 or native HTML. The data protection team is informed via a corresponding e-mail in order to implement the request in a legally valid manner.
If you create such a form, you should keep it as flexible as possible. For example, in addition to the opt-out option, you can offer further checkboxes in which users can specify exactly which data should not be passed on. In addition, fields such as first and last name and an email address should be requested to ensure that it is clear which person is objecting. However, it should be noted that as little data as possible should be collected - the principle of data minimization according to the GDPR requires that only the data that is really necessary is collected. An additional reference to the processing of the data provided in the form is therefore usually advisable.
Making sensible use of extended data protection pages
Whether you reach European or US users - an expanded data protection page creates transparency and reduces the risk of legal action. Adapt content regularly to new data protection regulations. Information obligations, opt-out options and contact options for data management are key here. With targeted adjustments to your WordPress theme, this can be visually integrated without being disruptive.
You can also read the Data protection overview for online projectsif you want to delve deeper into legal requirements.
To ensure that extended data protection pages fit seamlessly into the overall appearance, you can visually adapt them to the rest of the theme. This keeps the corporate design consistent, which creates trust. Also think about regular internal training: Your team working with the website should know which requirements apply in each case and how to respond to questions from users. A well-positioned support team can also improve the data protection experience. For international projects in particular, it is worth providing the website in different language versions without losing sight of the country-specific data protection regulations. This ensures a uniform and at the same time regionally correct data protection experience.
Regardless of whether you process large amounts of personal data or only collect newsletter data: The principle of transparency remains the foundation of a reputable online presence. The more clearly you make it clear that you respect the privacy of your visitors, the more likely they are to trust your site. A correct and well-placed Do Not Sell My Info page is a decisive building block in meeting this requirement.
