Overview
This check drives the CMP's own "Reject All" or equivalent opt-out control and confirms that tags classified as advertising or sharing stop sending requests on every subsequent page view in the session, not just the page where the opt-out was clicked.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations.
Why it is important
Continued tag firing after a consumer exercises their "Do Not Sell or Share" right is one of the most visible and enforceable CCPA violations, because it is detectable from outside the organization by any regulator, journalist, or plaintiff simply by clicking opt-out and watching network traffic. Recent CPPA enforcement activity has specifically highlighted multimillion-dollar settlements tied to opt-out failures, underscoring that this is an active, not theoretical, enforcement priority.
Implementation
Configure a Reject-All (Opt-Out) Audit using the
privacyoptoutpre-audit action so the reject path is driven through the CMP's own SDK.Check the pre-built ObservePoint report for Advertising/Sharing Tags Firing Under Opt-Out or GPC.
Any tag in the report above is a leak. Cross-reference it against your Sale/Share tag inventory before treating it as a violation rather than an expected functional tag.
Exception to watch for: not every non-essential tag is a "sale" or "share" under CCPA's definitions (first-party analytics with no outbound identifier, contracted service-provider tags, and cookieless pings with nothing personal transmitted don't count).
Cross-reference anything flagged against your labeled "CCPA Sale/Share" tag inventory before treating it as a violation.
Remediation
For remediation, check the following steps:
For each tag confirmed in the leak delta, open its trigger configuration in the tag manager and verify it listens for the CMP's opt-out event and is explicitly blocked when the advertising/sharing consent category is denied, a common root cause is a tag configured to block only on "deny all" rather than on the specific category relevant to it.
If the vendor's own script re-fires independently of the tag manager (a common failure mode for pixels embedded directly in page code rather than routed through the CMS), work with engineering to either remove the direct embed or wrap it in a consent-gated conditional.
Re-run the Opt-Out audit and
compare_consent_statesafter each fix to confirm the delta is empty, and add the corrected tag to a regression Rule so a future release can't silently reintroduce the leak.
Conclusion
This is the check most directly tied to enforceable, court-tested CCPA violations, and validating it with compare_consent_states on a recurring schedule turns a one-time fix into durable, audit-ready evidence that the opt-out actually works.