Do Not Sell My Personal Information (DMSMPI) requests empower consumers to restrict how businesses use and share their personal data. This guide explains what a DMSMPI request is, who it applies to, and the practical steps to submit one to a company. It covers common processes, verification requirements, and tips to improve success rates while staying within legal rights under U.S. privacy laws such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
What A Do Not Sell My Personal Information Request Is
A DMSMPI request is a formal notice that a consumer does not want a business to sell their personal data to third parties. It typically applies to California residents under CCPA/CPRA, but many states have similar rights or companies extend these rights nationwide. When a request is accepted, the business must stop selling your data to third parties and, in many cases, must honor a limit on sharing data for targeted advertising or analytics. Some companies offer a single opt-out option, while others distinguish between selling and sharing for business purposes.
Who Is Covered And Where The Rights Apply
Most U.S. companies that collect personal information from residents of California are subject to CCPA/CPRA, especially if they meet certain thresholds. Even if a person lives outside California, many firms honor DMSMPI requests due to consumer expectations and state privacy laws. Companies may also extend DMSMPI rights to customers under state privacy laws like Virginia’s VCDPA, Colorado’s CPA, or Utah’s UCPA. The practical effect is that a consumer should submit the request to each relevant company to ensure their data is not sold.
Preparing To Make A DMSMPI Request
Before submitting, gather essential information to speed up verification and processing. This includes your full name, current address, email, and any account numbers or identifiers tied to the company. Collect evidence that proves identity if required, such as a copy of a government-issued ID, last four digits of a payment method, or a recent utility bill. Review the company’s privacy policy for the exact process, timelines, and any limits on requests. Note that some firms require a security verification step to prevent fraud.
Steps To Submit The Request
- Identify Affected Companies: List all firms with whom you have personal data, especially those that market products or services to you in the U.S.
- Find The Opt-Out Channel: Look for “Do Not Sell My Personal Information,” “Opt-Out,” “Privacy” or “California Privacy Rights” pages on the company website. Some use a web form, email address, or a dedicated privacy portal.
- Choose The Method: Prefer the formal DMSMPI form if available. If not, use the company’s privacy contact or designated form for data rights requests.
- Provide Required Information: Include your identity verification details as requested. Be specific about the scope of the request (e.g., all data sold to third parties in the past 12 months, or all data ever shared).
- Submit And Confirm: After submitting, save a confirmation or ticket number. Note the company’s stated response window (often 30 days, with possible extensions).
- Track And Follow Up: If there is no response within the allotted time, send a polite follow-up referencing your initial request and confirmation number.
Verification And What To Expect
Most companies require identity verification to prevent fraud. This could involve confirming personal details, providing a government ID, or confirming data points tied to your account. Processing may take up to 30 days, with possible two 15-day extensions in some cases. You will typically receive a confirmation email and a final decision indicating whether data sales have ceased, and if not, what data was exempt or still allowed for certain purposes.
What Happens After Submission
If the request is approved, the company should stop selling your data to third parties and may limit sharing for targeted advertising. Some firms offer a data access or deletion option alongside DMSMPI; others separate these rights. Keep records of all communications and any modifications to your data sharing preferences. If your data is still being sold, consider escalating the issue through regulatory channels or seeking consumer protection guidance.
Common Pitfalls And How To Avoid Them
- Ensure you provide all required identifiers to avoid delays. Double-check the scope of the request.
- Narrow the request to specific data categories or timeframes to improve processing accuracy and speed.
- Include contact information and request a written acknowledgment with a timeline and reference number.
- Complete identity verification even if it seems intrusive; failure can stall or invalidate the request.
Sample Language For A DMSMPI Request
Below is a concise template that can be adapted to most companies. Replace placeholders with your information and tailor the scope to your needs.
To Whom It May Concern, I am requesting a Do Not Sell My Personal Information under the CCPA/CPRA (where applicable). Please cease selling my personal data to third parties and confirm in writing within the legally required timeframe. For reference, my account identifier is [ACCOUNT ID], and my contact email is [EMAIL]. If you require additional information to verify my identity, please inform me of the steps. Thank you for your prompt assistance.
Where To Find Resources And Support
Many consumer rights organizations, state attorneys general offices, and privacy advocacy groups provide guidance on DMSMPI processes and timelines. When in doubt, consult the company’s privacy policy, the California Attorney General’s privacy resources, or state consumer protection agencies for how to file a complaint if a request is mishandled.
Tips For A Higher Success Rate
- Specify data types and the period you want covered to avoid ambiguity.
- Always submit through the company’s designated DMSMPI channel to ensure proper routing.
- Save confirmation emails, reference numbers, and any correspondence for future follow-up.
- If no response within the legal window, send a formal reminder or contact the privacy office directly.