CCPA sale
By Gareth HoyleLast updated How we research
A CCPA sale is a disclosure of a consumer's personal information to a third party for money or other valuable consideration, which consumers can opt out of.
A CCPA sale is any selling, renting, releasing, disclosing or otherwise making available of a consumer's personal information by a business to a third party "for monetary or other valuable consideration", under California Civil Code section 1798.140(ad). The definition is broad, so a paid license of customer or employee records to an AI developer is normally a sale.
What does a sale trigger?
A sale gives consumers the right to opt out, requires a notice and a "Do Not Sell or Share My Personal Information" link, and means honoring opt-out preference signals. For consumers the business knows are under 16, the CCPA requires opt-in consent before a sale. Section 1798.140(ad)(2) excludes some transfers, including assets passed in a merger, acquisition or bankruptcy.
How do sellers avoid a sale?
Sellers avoid a sale by removing personal information. Data that meets the CCPA's de-identification standard in section 1798.140(m) is not personal information. Our guide to CCPA, state privacy laws and GDPR covers the other state laws, which define a sale in different ways. Virginia, for example, covers only exchanges for monetary consideration.
UK and EU GDPR have no separate concept of a sale. Any disclosure is processing that needs a lawful basis.