{
  "id": "POL-136",
  "slug": "pol-136",
  "title": "A business that sells or shares must publish the Do-Not-Sell link",
  "statement": "Where the business sells or shares personal information, the \"Do Not Sell or Share My Personal Information\" link must be published on the site.",
  "rationale": "California requires the link wherever the business does either, and its absence is a compliance failure in its own right. It is worth pairing with the messaging carve-out deliberately rather than by accident: publishing the link invites a reviewer to ask whether the messaging data is inside the request, which is the question POL-067 exists to answer in advance.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "site-wide Do-Not-Sell link",
  "severity": "HIGH",
  "detectability": [
    "CRAWL"
  ],
  "failureClass": "TERMINAL_WEBSITE",
  "authorities": [
    "CCPA"
  ],
  "codes": [
    {
      "provider": "Bandwidth",
      "code": "7103",
      "remediable": true
    }
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Publish the link in the site footer and state next to it that messaging opt-in data is excluded from sale or sharing in any case. Done when the link is present and the exclusion is unambiguous.",
  "notes": "Conditional on the business selling or sharing personal information, which no applicability dimension expresses; the criteria pass immediately where the policy discloses neither. Pair with POL-067 — publishing the link without the carve-out statement is the trap.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-136/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-136.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}