California and State-Specific Opt-Out Rights

What it is

If you live in California or certain other states, you have the legal right to stop Target from selling or sharing your personal data for targeted advertising. You can do this by clicking 'Your Privacy Choices' on the Target website or app, or by using a browser tool called Global Privacy Control.

Why it matters (compliance & governance perspective)

This provision confirms that consumers in covered states have a legally enforceable right to opt out of a significant portion of Target's data sharing for advertising purposes, and it provides a clear mechanism to exercise that right.

Consumer impact (what this means for users)

California residents and residents of several other states with comprehensive privacy laws can opt out of having their personal information sold or shared for cross-context behavioral advertising by using a clearly identified link on Target's website or app. Recognizing the Global Privacy Control signal is a CPRA compliance requirement and its inclusion here confirms it is available as a mechanism.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: CPRA Section 1798.120 grants California consumers the right to opt out of the sale or sharing of personal information; the California Privacy Protection Agency enforces this requirement. Recognition of the Global Privacy Control (GPC) as a valid opt-out signal is mandated under CPRA regulations. Virginia, Colorado, Texas, Connecticut, and other states with comprehensive privacy laws impose analogous opt-out rights for targeted advertising, each with its own enforcement authority. 2. GOVERNANCE EXPOSURE: Medium. The policy discloses the opt-out mechanism and references GPC recognition, which reflects compliance with current CPRA requirements. The adequacy of this provision depends on whether the underlying technical implementation of the opt-out and GPC recognition is fully functional across all Target's digital properties and all third-party data sharing flows, including Roundel. 3. JURISDICTION FLAGS: California creates the most immediate compliance obligation, but the multi-state reference in the policy indicates Target has assessed applicability in Virginia, Colorado, Texas, and Connecticut at minimum. As additional states enact comprehensive privacy laws, the scope of this provision will need to expand. The policy should be monitored for whether it is updated to reflect new state law effective dates. 4. CONTRACT AND VENDOR IMPLICATIONS: Opt-out signals processed under this provision must propagate to all downstream advertising and analytics vendors. Contracts with advertising technology partners should include obligations to honor opt-out status and cease processing of opted-out consumers' data for targeted advertising. 5. COMPLIANCE CONSIDERATIONS: The compliance team should conduct periodic testing of the opt-out mechanism and GPC recognition to ensure functional compliance across all platforms. Data flows from opted-out consumers should be audited to confirm that sharing with Roundel partners and third-party advertising companies is suspended upon opt-out. The policy should be reviewed annually or upon each new state privacy law effective date to ensure the description of covered states and available rights remains accurate.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data Collection high
• Roundel Retail Media Advertising Network high
• Precise Geolocation Collection medium
• Third-Party Data Sources and Data Brokers medium
• Children's Privacy and Age Restrictions low
• Data Retention Practices medium