Know where your consent setup needs work.

California requires businesses that 'sell' or 'share' personal information (which includes most advertising and many analytics cookies used for cross-context behavioral advertising) to automatically honor opt-out preference signals such as Global Privacy Control (GPC). This is mandatory under Cal. Code Regs. tit. 11 § 7025 — not optional. Provide a 'Do Not Sell or Share My Personal Information' link and, where sensitive personal information is used beyond the purposes permitted by § 7027, a 'Limit the Use of My Sensitive Personal Information' link; these may be combined into a single 'Your Privacy Choices' link with the opt-out icon. A notice at collection must be presented at or before the point of collection. Opt-out methods must be symmetrical and free of dark patterns — opting out must be at least as easy as opting in. The CPPA and California Attorney General actively enforce: the Sephora settlement ($1.2M, 2022) penalized failure to honor GPC and to disclose sales, and 2025 CPPA enforcement actions targeted non-compliant opt-out flows and excessive data collection in opt-out webforms.

For Canada outside Quebec, model the default banner as opt-out when online behavioral advertising is limited to non-sensitive data, purposes are clearly explained at or before collection, the opt-out is easy, immediate, and persistent, and users are told who is involved. Keep an opt-in flow for sensitive data, unexpected tracking, location tracking, children, or processing that creates meaningful residual risk of significant harm.