The third core CCPA right is the right to opt out of data sales. We’ve already discussed the broad definition of sale underlying this right, and your privacy policy should explain this right to consumers. If a consumer chooses to “opt-out” of sales, you should stop making any data transfers that would constitute a sale, and you should wait 12 months before asking a consumer if they would like to opt back in to sales.