Opt-Out (CCPA)

CCPA guest opt-out

The CCPA requires that users can opt out of data sale/sharing without creating an account or logging in. The opt-out system supports both authenticated users and anonymous visitors.

Flow

1. POST /privacy/opt-out is [AllowAnonymous]
2. If authenticated → opt-out recorded against UserId
3. If anonymous → AnonymousTrackId generated, stored in _optout_id HTTP-Only cookie
4. Idempotent — repeated requests return existing opt-out status

Cookie _optout_id

Property	Value
Category	StrictlyNecessary (registered in ICookieRegistry)
HttpOnly	true
Secure	true
SameSite	Lax
Retention	730 days (2 years)

Cart merge (anonymous → authenticated)

When a visitor logs in after opting out anonymously, the application should merge the anonymous opt-out with their user profile:

// In your login handler (e.g., Wolverine handler on UserLoggedInEto)
await optOutWriter.MergeAnonymousAsync(anonymousTrackId, userId);

The framework provides the IOptOutRecordWriter.MergeAnonymousAsync() interface; the merge call is application-level logic, not auto-triggered.

Endpoints

Method	Route	Operation	Auth
POST	/opt-out	RequestOptOut	Anonymous
GET	/opt-out/status	GetOptOutStatus	Anonymous

Tip

Applications must provide an opt-out store implementation via privacy.UseOptOutRecordStore<T>(). Without it, the opt-out endpoints return 501.

Setup

context.Services.AddGranitPrivacy(privacy =>
{
    privacy.UseOptOutRecordStore<EfCoreOptOutRecordStore>();
});