Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
California residents must complete two separate steps to fully opt out of the sale or sharing of their personal data: submit a webform request and disable advertising cookies via the website footer link on each browser and device used.
This analysis describes what Zendesk's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires California residents to take two distinct actions to exercise their CCPA opt-out right, and states that cookie blocking or clearing will negate the opt-out for automatically collected device data. The operational complexity of this mechanism may affect whether residents can effectively exercise their statutory opt-out right, particularly across multiple devices and browsers.
Interpretive note: Whether the two-step, per-device opt-out mechanism satisfies the CPRA's 'easy opt-out' standard is subject to regulatory interpretation by the CPPA and has not been definitively resolved by published enforcement guidance.
Under this clause, California residents who do not complete both steps, or who block or clear cookies, will not have their opt-out fully honored for device-level data automatically collected and shared with advertising technology partners. The agreement requires this process to be repeated on each browser and device.
Cross-platform context
See how other platforms handle California Two-Step Opt-Out Requirement and similar clauses.
Compare across platforms →Monitoring
Zendesk has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"In order to fully exercise the Right to Opt Out of Sale or Sharing with respect to any 'sale' or 'sharing' of information, you must undertake both of the following steps: Submit a Right to Opt Out of Sale or Sharing request using our webform; and Disable the use of advertising cookies and other tracking technologies by clicking the 'Do Not Sell or Share My Personal Information' link in our website footer. You must complete this step on each of our Sites from each browser and on each device that you use. These steps are necessary so that we can place a first-party cookie signaling that you have opted out on each browser and each device you use. If you block cookies, we will be unable to comply with your Right to Opt Out of Sale or Sharing request for device data that we automatically collect and disclose to third parties online using cookies, pixels, and other tracking technologies. If you clear the cookies in your browser, you will need to follow Step 2 above again.Excerpt from Zendesk's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates the CCPA and CPRA, enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. The CPRA requires businesses to provide an easy mechanism for opting out of sale and sharing, and the adequacy of a two-step, per-device process may warrant evaluation under CPPA enforcement guidance. The provision also engages FTC consumer protection authority regarding deceptive or unfair practices. 2. GOVERNANCE EXPOSURE: Medium. The two-step requirement and the cookie-dependency for opt-out compliance create operational risk if regulators determine that the mechanism does not meet the 'easy opt-out' standard under CPRA. The document's statement that cookie blocking prevents full opt-out compliance may draw regulatory scrutiny. 3. JURISDICTION FLAGS: This provision applies exclusively to California residents. Other states with comprehensive privacy laws (such as Colorado, Virginia, Connecticut) may impose similar opt-out obligations that Zendesk's single mechanism may not fully address, depending on those states' specific requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Businesses that embed Zendesk's Digital Properties or use Zendesk as a marketing tool should assess whether their own CCPA compliance programs account for data flows through Zendesk's cookie and tracking technology ecosystem. Vendor assessments should confirm whether Zendesk's opt-out mechanism satisfies applicable state law requirements. 5. COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the two-step opt-out mechanism satisfies the CPRA's mandate for an easy opt-out, particularly the per-device and per-browser cookie requirement. The notice's acknowledgment that cookie blocking prevents opt-out compliance may require additional technical or procedural controls. Teams should also assess whether Global Privacy Control signals are honored, as the notice references honoring 'commonly-used and recognized' opt-out signals only 'to the extent required by California law,' which may be interpreted as conditional rather than unconditional compliance.
This provision requires California residents to take two distinct actions to exercise their CCPA opt-out right, and states that cookie blocking or clearing will negate the opt-out for automatically collected device data. The operational complexity of this mechanism may affect whether residents can effectively exercise their statutory opt-out right, particularly across multiple devices and browsers.
Under this clause, California residents who do not complete both steps, or who block or clear cookies, will not have their opt-out fully honored for device-level data automatically collected and shared with advertising technology partners. The agreement requires this process to be repeated on each browser and device.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zendesk.