Disappointing that they would mandate details about the opt-out process for selling personal information instead of mandating that it be an opt-in process.
That is not within the CA Attorney General's control. The statute (CCPA) specifies opt-out, not opt-in, for most consumers. (The exception is for children under 16, who get an opt-in process.)
How does a website proactively select opt-in without knowing its users’ ages?