Do Not Sell My Info Rights With Online Lenders

That small link at the bottom of a lender's website, the one labeled Do Not Sell My Info, is easy to overlook. Yet it represents one of the strongest privacy tools available to consumers in the United States. If you have applied for a short-term loan, a payday advance, or an installment loan online, your personal information has likely moved through several hands: the matching platform, the lender, and possibly data brokers and marketing partners. Understanding your do not sell my info rights with online lenders gives you real control over that flow. It is not a gimmick, and it is not a one-click fix for every privacy concern, but knowing how it works, what it covers, and what to expect after you use it can meaningfully limit how your financial data travels. This guide walks through the law behind the link, the mechanics of submitting an opt-out, the difference between opting out and deleting your data, and the timelines you should hold companies to.

What the CCPA Means by Selling or Sharing Your Information

The Do Not Sell My Info link exists because of the California Consumer Privacy Act, or CCPA, which took effect in 2020 and was expanded by the California Privacy Rights Act in 2023. The law gives California residents specific rights over their personal information, and it requires businesses that meet certain thresholds to post a clear link allowing consumers to opt out of the sale or sharing of their data. Because many financial platforms serve customers nationwide, these links now appear on sites well beyond California, and several other states have passed similar laws with comparable opt-out rights.

The word sale is broader than most people assume. Under the CCPA, a sale does not require an exchange of money. It can include renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to another business for monetary or other valuable consideration. When an online lending platform shares your contact details, application data, or loan inquiry with a network of third-party lenders, that transfer can qualify as a sale or sharing under the law, even if no cash changes hands and the platform is compensated through lead generation arrangements.

Sharing has a separate meaning that targets cross-context behavioral advertising. If a business passes your information to advertising partners so that you see tailored offers across different websites, that counts as sharing. For a loan applicant, this often looks like a flood of text messages, emails, and calls from lenders and marketers after a single application. The opt-out link is designed to stop that cross-context sharing and any sale of your data to third parties.

It helps to know what the opt-out does not cover. It does not stop the lender you actually chose from using your information to process your loan, service your account, verify your identity, or comply with legal obligations. Those are internal business purposes and are treated differently from selling. It also does not erase your application history or cancel a loan. The right to opt out is about limiting onward distribution, not about undoing a transaction you already completed.

How to Submit a Do Not Sell My Info Request

Submitting an opt-out is intentionally simple, and the law requires businesses to make it easy. You should not have to create an account, pay a fee, or jump through extra hoops just to stop the sale of your data. Most online lending platforms offer at least two paths: the dedicated Do Not Sell My Info link in the website footer, and a toll-free phone number or email address listed in the privacy policy.

Here is a practical sequence you can follow when you want to opt out with an online lender or a loan matching platform:

1. Find the Do Not Sell My Info link, usually in the footer under privacy or legal links, and open it.
2. Provide the minimum identifying information the form requests, typically your name, email, and sometimes your state of residence.
3. Confirm your request through any verification step, such as a reply email or a one-time code.
4. Save a screenshot or copy of the confirmation page and any follow-up email for your records.

Verification is a normal part of the process, but it should be proportionate. A business may ask you to confirm that you are the person making the request, especially if your data is sensitive financial information. What it should not do is demand excessive documentation or make the process so burdensome that you give up. If a company asks for a notarized form or a copy of your Social Security card just to opt out, that is a red flag worth questioning.

If a platform operates as a loan matching service rather than a direct lender, your request to that platform limits what the platform itself sells or shares. It does not automatically bind every third-party lender in the network. For that reason, it is smart to submit opt-out requests to the specific lenders whose offers you accepted, and to any data brokers you notice contacting you. If you are exploring loan options and want to understand how secured and unsecured products differ before you apply, our guide on secured vs unsecured loans explains the tradeoffs in plain terms.

You can also use authorized agents in some cases, and businesses must honor opt-out requests made through an opt-out preference signal, such as a browser setting that communicates your choice automatically. These signals are growing in support, and using one alongside a direct request gives you layered protection.

What Happens After You Opt Out

Once a business receives and verifies your opt-out request, it must stop selling or sharing your personal information. It must also direct its service providers and contractors to stop selling or sharing the data they received from the business. This downstream instruction matters because many platforms rely on vendors for marketing, analytics, and lead distribution. A compliant business passes the opt-out requirement down the chain.

You should expect the flow of marketing messages to slow, though not necessarily stop overnight. Some communications may continue for a short period while systems update, and some may come from parties you did business with directly rather than from the platform you opted out with. If messages persist well beyond the stated window, that is a signal to escalate.

The opt-out does not expire in the way some people fear. Under the CCPA, a business must wait at least twelve months before asking you to opt back in, and it cannot simply ignore your choice. If you later decide you want to receive tailored offers again, you can usually opt back in, but the default should remain your prior choice.

One nuance involves the difference between a platform and its lending partners. When you submit a request on a matching site, you are exercising your rights against that site. The lenders in its network are separate businesses with their own privacy obligations. A thorough approach is to opt out everywhere you have submitted an application, and to keep a simple log of the companies, dates, and confirmation numbers so you can follow up if needed.

Opting Out Versus Deleting Your Data

Opting out and deleting are two different rights, and conflating them leads to frustration. Opting out stops the sale and sharing of your information going forward. Deletion, by contrast, asks a business to remove personal information it has collected from you, subject to exceptions. You can exercise both, and many consumers should.

Deletion requests come with important limits. A lender may keep certain records to complete a transaction, detect security incidents, comply with legal obligations, or maintain records required by financial regulation. Loan servicers, for example, are often required to retain application and repayment records for set periods. So even a successful deletion request may not remove everything, and that is lawful.

Here is how the two rights differ in practice:

• Opt-out: stops future sales and sharing, takes effect quickly, and does not require deletion of your records.
• Deletion: removes covered personal information, may take longer to process, and is subject to legal and operational exceptions.
• Correction: lets you fix inaccurate data, which matters if a lender or broker holds wrong information about your credit or identity.
• Access: lets you request a copy of what a business has collected about you, which can reveal who received your data.

A sensible order is to submit the opt-out first, because it is fast and stops the bleeding, then follow with an access request to see what data exists, and finally a deletion request for anything you do not want retained. Each request should be logged with the date and any confirmation you receive, since you may need that record if a company fails to respond.

It is also worth reading the privacy policy and the data broker statement that many financial platforms publish. These documents explain what categories of information are collected, who receives it, and how long it is kept. If you are comparing loan options and want to see how a matching platform handles consumer data in practice, you can review the ExpressCash platform, which connects borrowers with third-party lenders and publishes privacy and opt-out information for consumers.

Timelines and Confirmation You Should Expect

The CCPA sets clear timing expectations. For opt-out requests, a business must comply as soon as feasibly possible, and the law contemplates that this happen promptly, generally within fifteen business days. For requests to know or delete, the business generally has forty-five calendar days to respond, with a possible extension of another forty-five days if it notifies you and explains the reason.

Confirmation practices vary, but a well-run company will acknowledge your request quickly and tell you what happens next. Look for a confirmation that includes the date the request was received, the scope of what was opted out, and a contact point for questions. If you used an online form, the confirmation may arrive by email within a few business days. If you called, ask for a reference number.

If a business misses the deadline or ignores your request, you have options. You can follow up in writing, reference the specific law and deadline, and ask for a status update. You can also file a complaint with the California Privacy Protection Agency or the state attorney general, and in states with newer privacy laws, with the relevant state regulator. Keeping your confirmation records makes these escalations far more effective.

Finally, treat your opt-out as part of a broader privacy routine rather than a one-time task. Review the privacy settings on the platforms you use, limit the information you share in loan applications to what is required, watch for unexpected messages after applying, and repeat your opt-out requests when you open new accounts. Used consistently, the Do Not Sell My Info link is a practical, enforceable tool that puts you in charge of how your financial information circulates online.