# CCPA, state privacy laws and GDPR when selling data for AI

URL: https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training
Reviewed: 2026-11-08

The CCPA treats a transfer of personal information to an AI buyer for money or other value as a sale, unless the data meets California's three-part de-identification standard. More than 20 other states now have comprehensive privacy laws, HIPAA covers health data and the FTC polices privacy promises. UK and EU GDPR apply to people there. Most sellers de-identify or exclude personal data before licensing.

## Key takeaways

- Under the CCPA, licensing personal information for value is a sale unless the data is deidentified under Civil Code section 1798.140(m).
- California's deidentified standard has three parts: reasonable technical measures, a public commitment not to re-identify, and contracts binding every recipient.
- The CCPA covers employee and job applicant data. Husch Blackwell reports that every other state comprehensive privacy law generally exempts employee and B2B data.
- FTC staff warn that a surreptitious, retroactive privacy policy change to allow AI training may be unfair or deceptive.
- For UK and EU records, the ICO says pseudonymized data stays personal data for anyone holding the key, and EDPB Opinion 28/2024 says trained models are not always anonymous.

Most company archives contain personal data: names in emails, customers in support tickets, staff in chat. This guide explains how the California Consumer Privacy Act, the other US state privacy laws, the FTC and HIPAA treat licensing those records to an AI buyer. A separate section covers UK GDPR and EU GDPR for records about people there.

> **Not legal advice** This guide summarizes what the law and regulators say. It is not advice on your situation. Sell My Data To AI is a broker, not a law firm. Take independent legal advice before licensing any data that contains or was derived from personal data.

## Does the CCPA apply when you sell data for AI training?

The CCPA applies when a business it covers licenses personal information about California residents. The California Attorney General says the law covers for-profit businesses that do business in California and have gross annual revenue over $25 million, buy, sell or share the personal information of 100,000 or more California residents or households, or derive 50% or more of their annual revenue from selling it. The California Privacy Protection Agency raised the revenue threshold to $26,625,000 from January 1, 2025.

The CCPA reaches staff records as well as customer records. The Attorney General notes that the exemptions for employment-related personal information expired on December 31, 2022, so employee and job applicant data has been covered since January 1, 2023. Staff email and chat are in scope, not only CRM records and support tickets.

## How does the CCPA treat selling data for AI training?

The CCPA treats a transfer of personal information to an AI company for money or other value as a sale. Section 1798.140(ad) defines a sale as selling, renting, releasing, disclosing, making available, transferring or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration.

A sale brings duties with it. Section 1798.120 gives consumers the right to opt out of the sale of their personal information and requires a business that sells it to tell them so. Section 1798.100 bars a business from using personal information for additional purposes incompatible with the ones it disclosed at collection without giving notice.

Risk assessments now apply too. Brownstein Hyatt Farber Schreck reports that risk assessment duties under the CPPA's new regulations began on January 1, 2026, that selling or sharing personal information is one of the activities that trigger them, and that assessments for 2026 and 2027 must be submitted to the agency by April 1, 2028.

Penalties are set per violation. The CPPA's adjusted amounts, in force from January 1, 2025, are up to $2,663 for each violation and $7,988 for each intentional violation.

## When is data de-identified under the CCPA?

Data is de-identified under the CCPA when it cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, and the business holding it meets three conditions in section 1798.140(m).

1. It takes reasonable measures to ensure the information cannot be associated with a consumer or household
2. It publicly commits to keep and use the information in de-identified form and not to attempt to re-identify it
3. It contractually obligates every recipient to comply with the same requirements

The second and third conditions are what buyers now write into licenses. Nixon Peabody makes the point in its October 2026 diligence alert, and the Spirit Airlines case shows it in practice: The Next Web reported that the buyer must publicly commit not to re-identify the data and may pass it on only to recipients who make the same commitment.

## What about the other US state privacy laws?

The other US state privacy laws follow a similar model but usually reach less of a company archive. Husch Blackwell reported in June 2026 that the number of states with comprehensive privacy laws had grown from 20 to 24, including Virginia, Colorado, Connecticut, Texas, Oregon and New Jersey.

The same report says the CCPA is the only one with no exemption for employee or B2B data. Staff email and chat therefore usually fall outside the other state laws, while customer records may still be covered where a company meets a state's thresholds. Check where the consumers in each dataset live, and read each state's definitions of sale and de-identified data as a separate test.

## Which federal laws apply to personal data in a data sale?

Four federal laws come up in most company data sales. The FTC Act applies across most of the economy, while HIPAA, GLBA and FERPA apply to health, financial and education records.

| Law | Who it covers | Rule for a data license | De-identification route |
| --- | --- | --- | --- |
| FTC Act Section 5 | Most businesses | No unfair or deceptive practices, including retroactive privacy policy changes | Not defined by the statute, so follow your own published promises |
| HIPAA | Covered entities and business associates | A sale of protected health information needs an authorization that states the payment | Safe Harbor (18 identifiers removed) or Expert Determination, under 45 CFR 164.514 |
| GLBA | Financial institutions | A privacy notice and a chance to opt out before disclosing nonpublic personal information to a nonaffiliated third party | Not set by the statute, so most sellers exclude customer financial records |
| FERPA | Educational agencies and institutions | Signed, dated written consent before disclosing education records | Release allowed once all personally identifiable information is removed, under 34 CFR 99.31(b) |

FTC staff's February 2024 post is the one most sellers need to read. It says a business that collects user data based on one set of privacy commitments cannot then unilaterally renege on them, and cites the FTC's 2004 Gateway Learning case and a 2023 case against the genetic testing company 1Health. Frankfurt Kurnit Klein and Selz notes that consent is needed for past data where notices did not cover the new use.

Biometric data has its own state laws. Illinois' Biometric Information Privacy Act lists voiceprints and scans of face geometry as biometric identifiers, bars private entities from selling, leasing, trading or otherwise profiting from them, and sets liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation. Our guide to [licensing video and audio archives](https://sellmydatatoai.net/guides/sell-video-and-audio-for-ai-training) covers recording consent rules.

## If you hold UK or EU data

UK GDPR and EU GDPR apply when the records you license contain personal data about people in the UK or EU. They set a different test from the CCPA: data falls outside GDPR only if it is truly anonymous, judged under Recital 26 by all the means reasonably likely to be used to identify someone.

### When is data anonymous under the ICO's guidance?

Data is anonymous under the ICO's guidance when the risk of identifying anyone from it is sufficiently remote. The ICO published its anonymization guidance in March 2025, according to Taylor Wessing's summary, and says it is under review following the Data (Use and Access) Act, which became law on June 19, 2025.

- Identifiability sits on a spectrum, with a blurred band between clearly personal and clearly anonymous data
- The motivated intruder test asks whether a determined person with access to resources and expertise could identify individuals
- Identifiability depends on context and can change over time, so the assessment should be reviewed when new recipients are given access
- The ICO treats [anonymization](https://sellmydatatoai.net/glossary/anonymization) as processing in itself, so it needs a lawful basis, and expects a data protection impact assessment

### Is pseudonymized data still personal data?

Pseudonymized data is still personal data for anyone who holds the additional information needed to re-identify it, according to the ICO, though it may be anonymous in the hands of a recipient without that information. In EDPS v SRB, decided on September 4, 2025, the EU Court of Justice held that pseudonymized data may not be personal data for a recipient who cannot re-identify people by means reasonably likely to be used, according to Clifford Chance. The duty to tell people about recipients is still judged from the original controller's side.

For a seller, [pseudonymization](https://sellmydatatoai.net/glossary/pseudonymization) reduces risk, but it is not a way out of GDPR while you keep the key.

### What lawful basis do you need?

You need one of the lawful bases in Article 6 of UK GDPR or EU GDPR to disclose personal data for AI training, and the new purpose must be compatible with the original one. Most commercial sellers would look at legitimate interests, which needs a purpose test, a necessity test and a balancing test. Article 14(1)(e) requires controllers to tell people about recipients of their data, and Article 14(4), like Article 13(3), requires notice before further processing for a new purpose. Special category data, such as health information, also needs an Article 9 condition.

### What does EDPB Opinion 28/2024 say about AI training data?

EDPB Opinion 28/2024, adopted by the European Data Protection Board on December 17, 2024 at the request of the Irish supervisory authority, says AI models trained on personal data cannot always be treated as anonymous. It is addressed to supervisory authorities, but it shows how EU regulators are likely to assess AI cases.

| Topic | What the opinion says | Why it matters to a seller |
| --- | --- | --- |
| Anonymous models | A model is anonymous only if the likelihood of extracting personal data, directly or through queries, is insignificant, assessed case by case | Buyers cannot assume training removes personal data, so they will ask what was in yours |
| Legitimate interests | A three-step test: a lawful, clearly stated and real interest, necessity, and a balancing test | The same test applies to your decision to disclose |
| Reasonable expectations | Meeting the transparency rules is not enough on its own to show people expect the processing (paragraph 92) | An updated privacy notice may not make AI use expected |
| Unlawful development | A different controller deploying a model should check that it conducted an appropriate assessment of how the data was processed | Buyers will ask sellers for evidence that collection and disclosure were lawful |

### What has the Data (Use and Access) Act 2025 changed?

The Data (Use and Access) Act 2025 has amended the UK GDPR, and legislation.gov.uk shows Article 14(5)(b), one of the exemptions from telling people about indirectly collected data, as omitted from February 5, 2026. Check the current text and the ICO's latest guidance before relying on any exemption.

Licensing UK or EU personal data to a buyer in the US or elsewhere can also be a restricted international transfer, which needs its own safeguard. Data that is truly anonymous before it leaves avoids this.

## How do the CCPA, other state laws and GDPR compare?

The CCPA, the other state laws and GDPR all restrict selling personal data, but they draw the line in different places. The table compares the points that matter for a data license.

| Point | CCPA | Other state laws | UK and EU GDPR |
| --- | --- | --- | --- |
| Regulator | California Privacy Protection Agency and California Attorney General | Set by each state's law | The ICO in the UK, national authorities coordinated by the EDPB in the EU |
| Outside the law when | Data meets the three-part 1798.140(m) standard | Data meets that state's de-identified definition | Data is anonymous, judged by means reasonably likely to be used (Recital 26) |
| Employee data | Covered since January 1, 2023 | Generally exempt, according to Husch Blackwell | Covered |
| Pseudonymized data | Not de-identified unless all three conditions are met | Depends on each law's definition | Personal data for anyone holding the key, possibly not for a recipient who cannot re-identify (EDPS v SRB) |
| Key seller duties | Notice, opt-out and a risk assessment for a sale | Varies by state | Lawful basis, compatible purpose and transparency about recipients |

## What should you do before licensing records that contain personal data?

Before licensing records that contain personal data, decide what to exclude, document how the rest is de-identified and make the buyer contractually responsible for not re-identifying it. These steps follow the US, ICO and EDPB guidance cited above.

1. **Map the personal data**: List whose data is in each dataset (staff, customers, contacts at other companies), which states or countries they live in and which privacy notice applied when you collected it.
2. **Exclude the highest-risk records**: Take out HR files, health information, children's data, payment and financial account data, biometric data and anything you cannot de-identify reliably.
3. **Run a risk assessment**: The CCPA's regulations require one for selling personal information, and the ICO expects a data protection impact assessment for anonymization. Record the purpose, the risks and the measures you chose.
4. **De-identify by a documented method**: Remove direct and indirect identifiers, then run a [re-identification risk](https://sellmydatatoai.net/glossary/re-identification-risk) test on a sample. For health data, use HIPAA's Safe Harbor or Expert Determination method.
5. **Check notices**: Compare each dataset against the privacy notice in force when it was collected, and do not rely on a retroactive change to cover past data.
6. **Bind the buyer**: Make the public commitment not to re-identify, require the same from the buyer and any recipient, and set deletion dates for raw copies.
7. **Keep the file**: Store the assessment, the method, the test results and the certification. Buyers and acquirers will ask for them.

Our guides on [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) and [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) go further. EU-facing buyers also face disclosure duties of their own, explained in [the EU AI Act and training data transparency](https://sellmydatatoai.net/guides/eu-ai-act-training-data-transparency). For a rights pre-check on your records, [book a free consultation](https://sellmydatatoai.net/book-a-consultation?side=seller).

## Frequently asked questions

### Does the CCPA apply to employee data in a data sale?

The CCPA has applied to employee and job applicant data since January 1, 2023, when the exemptions for employment-related information expired, according to the California Attorney General. Licensing staff email or chat containing personal information for value can therefore be a sale under the CCPA, unless the data meets its de-identification standard.

### Is de-identified data covered by the CCPA?

Data that meets the CCPA's definition of deidentified falls outside its rules on personal information. Section 1798.140(m) requires that the data cannot reasonably be linked to a consumer, and that the business takes reasonable measures, publicly commits not to re-identify it and contractually binds every recipient to the same. Missing any one condition leaves the data as personal information.

### Do I need consent to sell data for AI training?

The CCPA generally uses notice and an opt-out for sales rather than consent, but your privacy notice still limits what you can do. FTC staff warn that retroactive privacy policy changes may be unfair or deceptive, and HIPAA requires authorization for a sale of protected health information. Frankfurt Kurnit Klein and Selz notes that consent is needed for past data where notices did not cover the new use.

### Do the other state privacy laws cover employee data?

Mostly not. Husch Blackwell reported in June 2026 that the CCPA is the only state comprehensive privacy law with no exemption for employee or B2B data, and that every other state law generally includes those exemptions. Customer records may still be covered, so check the law in each state where the people in your records live.

### Is anonymized data covered by UK GDPR?

Anonymized data is not covered by UK GDPR, provided it is truly anonymous. The ICO judges this by whether identification is reasonably likely, using tests such as the motivated intruder test. The ICO also treats the process of anonymizing personal data as processing, so that step needs a lawful basis.

### What is EDPB Opinion 28/2024?

EDPB Opinion 28/2024 is guidance from the European Data Protection Board, adopted on December 17, 2024, on personal data and AI models. It says models trained on personal data are not always anonymous, explains how legitimate interests applies to AI development, and sets out the consequences of unlawful processing during training.

### Does licensing UK or EU data to a US buyer raise transfer issues?

Licensing personal data from the UK or EU to a buyer in the US or elsewhere can be a restricted international transfer, which needs its own safeguard such as an adequacy decision or standard contractual clauses. Data that is truly anonymous before it leaves avoids this, which is one reason most sellers anonymize first.

## Sources

- [California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa), State of California Department of Justice, Office of the Attorney General, accessed November 2026
- [California Civil Code section 1798.140 (definitions)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), California Legislative Information, accessed November 2026
- [California Civil Code section 1798.100](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100), California Legislative Information, accessed November 2026
- [California Civil Code section 1798.120 (right to opt out of sale or sharing)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), California Legislative Information, accessed November 2026
- [California Privacy Protection Agency announces 2025 increases for CCPA fines and penalties](https://cppa.ca.gov/announcements/2024/20241217.html), California Privacy Protection Agency, accessed November 2026
- [Risk assessments under the new CCPA regulations commence Jan. 1, 2026](https://www.bhfs.com/insight/risk-assessments-under-the-new-ccpa-regulations-commence-jan-1-2026/), Brownstein Hyatt Farber Schreck, accessed November 2026
- [U.S. state privacy law landscape expands to 24 states](https://www.bytebacklaw.com/2026/06/u-s-state-privacy-law-landscape-expands-to-24-states-what-the-latest-legislative-wave-means-for-businesses/), Husch Blackwell (Byte Back), accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [Guidance regarding methods for de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), US Department of Health and Human Services, accessed November 2026
- [45 CFR 164.514: other requirements relating to uses and disclosures of protected health information](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), eCFR, accessed November 2026
- [45 CFR 164.508: uses and disclosures for which an authorization is required](https://www.law.cornell.edu/cfr/text/45/164.508), Legal Information Institute, Cornell Law School, accessed November 2026
- [15 U.S. Code section 6802: obligations with respect to disclosures of personal information](https://www.law.cornell.edu/uscode/text/15/6802), Legal Information Institute, Cornell Law School, accessed November 2026
- [34 CFR 99.31: disclosure of personally identifiable information without prior consent](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), eCFR, accessed November 2026
- [Biometric Information Privacy Act, 740 ILCS 14](https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57), Illinois General Assembly, accessed November 2026
- [Selling company data for AI training: what to know before you say yes](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes), Frankfurt Kurnit Klein and Selz, accessed November 2026
- [Shopping for AI training data: five diligence questions before you buy](https://www.nixonpeabody.com/insights/alerts/2026/10/26/shopping-for-ai-training-data-five-diligence-questions-before-you-buy), Nixon Peabody, accessed November 2026
- [Spirit's privacy ombudsman backs Google's $10m data deal](https://thenextweb.com/news/google-spirit-airlines-data-ombudsman-approval), The Next Web, accessed November 2026
- [Anonymisation guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/), Information Commissioner's Office, accessed November 2026
- [Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), Information Commissioner's Office, accessed November 2026
- [New ICO guidance on anonymisation and pseudonymisation](https://www.taylorwessing.com/de/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---new-ico-guidance-on-anonymisation-and-pseudonymisation), Taylor Wessing, accessed November 2026
- [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en), European Data Protection Board, accessed November 2026
- [Opinion 28/2024 (full text, PDF)](https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf), European Data Protection Board, accessed November 2026
- [Pseudonymized data after EDPS v SRB](https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/09/pseudonymized-data-after-edps-v-srb.html), Clifford Chance, accessed November 2026
- [UK GDPR Article 14: information to be provided where personal data have not been obtained from the data subject](https://www.legislation.gov.uk/eur/2016/679/article/14), legislation.gov.uk, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation