Published: Aug 05, 2025
Welcome to our blog series on LOCKED! LOCKED is an acronym for your privacy rights as a Californian — the strongest privacy rights in the nation thanks to the California Consumer Privacy Act (CCPA). It stands for limit, opt-out, correct, know, equal treatment, and delete. This will be a three-part blog series starting with the first two rights in the acronym: the right to limit and the right to opt-out.
Personal Information and Sensitive Personal Information
Before we discuss the right to limit and the right to opt-out, we must first define personal information and how it relates to sensitive personal information.
Personal information is any data that identifies, relates to, or could reasonably be linked to you or your household. A few examples of personal information include:
- Name or nickname
- Email address
- Purchase history
- Browsing history
- Location data
- Employment data
- IP address
- Profiles businesses create about you, including pseudonymous profiles (“user1234”)
- Sensitive personal information
Sensitive personal information or “SPI” is a subset of personal information, defined as:
- Identifying information (e.g. social security number, driver’s license)
- Financial data (e.g. debit or credit card numbers)
- Precise geolocation (within a radius of 1,850 feet)
- Demographic or protected-class information (e.g. race/ethnicity, religion, union membership)
- Biometric and genetic data (e.g. fingerprints, palm scans, facial recognition)
- Communications and content (e.g. mail, email, text messages)
- Health and sexual orientation (e.g. vaccine records, health history)
Right to Opt-Out
Californians have the right to opt-out of the sale and sharing of their personal information. That means you have the right to opt-out of the sale of your personal information to third parties (e.g. data brokers, advertisers). You also have the right to opt-out of the sharing of your personal information to prevent the targeting of ads across different businesses, websites, apps, or services.
CCPA-covered businesses must provide a link to allow you to exercise this right. It is usually found at the bottom of a webpage and will say “do not sell or share my personal information” or “your privacy choices.” Sometimes businesses offer privacy choices through a pop-up window or form
To opt-out of the sale and sharing of your personal information, click on the link or use the toggle provided by the business and follow the directions. Doing this on every website you visit can feel burdensome, but to ease the burden you can automatically select your privacy preferences for every website by using an opt-out preference signal, or OOPS for short.
An OOPS is a user-friendly and straightforward way for consumers to automatically exercise their right to opt-out of the sale and sharing of their personal information with the businesses they interact with online. An OOPS, such as the Global Privacy Control. It can either be a setting on your internet browser or a browser extension. With an OOPS, consumers do not have to submit individual requests to opt-out of sale or sharing with each business.
Right to Limit
Californians also have the right to direct businesses to limit the use and disclosure of their sensitive personal information.
Businesses covered under the CCPA must provide a link on their website that allows you to request the limiting of your SPI, if they plan on using it in certain ways. That link will also typically be at the bottom of a webpage and will say: “limit the use of my sensitive personal information” or “your privacy choices.” Once you send this request, the business must stop using your SPI for anything other than to:
- Provide requested goods or services
- Ensure security and integrity
- Prevent fraud
- Maintain system functionality
- Comply with legal obligations
Bringing it Together
In summary, the CCPA gives you the right to opt-out of the sale and sharing of your personal information and gives you additional rights to further limit the use and disclosure of your sensitive personal information.
When you exercise these rights together, you exert greater control in protecting your personal data which is important for your identity, safety, and financial health.
If you are on a business’s website and you can’t find the links to exercise your rights, remember to check their privacy policy. The privacy policy should tell you how you can exercise your rights under the law.
If you find your rights being violated, you can submit a complaint to CPPA.
Next in the LOCKED series, we will explore the right to correct and right to know. Follow us on social media to get live updates or check back in one week for the next post.