Sale vs Sharing Under the CCPA
Last reviewed: · By Victor Humenhuk (CIPP/US certified)
Under the CCPA as amended, a sale is any disclosure of personal information to a third party for monetary or other valuable consideration. Sharing is narrower in subject matter but broader in payment terms: it means disclosing personal information to a third party for cross-context behavioral advertising, whether or not anything of value is exchanged. California added sharing because ad-tech participants argued that passing data for ad targeting without payment was not a sale. Both trigger the same consumer opt-out right and are served by the same Do Not Sell or Share My Personal Information link.
What counts as a sale?
The CCPA defines a sale broadly. It covers selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information, orally, in writing or by electronic means, to a third party for monetary or other valuable consideration. The phrase "other valuable consideration" is what does the work: a data swap, a discount on services, or access to enriched analytics can all be consideration even though no invoice exists. The topic on sale and sharing walks through the statutory wording.
The statute then removes several transfers from the definition:
- Disclosures made at the consumer's direction, or where the consumer intentionally interacts with the third party.
- Communicating that a consumer has opted out, so the signal itself can be passed along.
- Disclosures to a service provider or contractor under a compliant written contract that restricts use of the data to the specified business purpose.
- Transfers of personal information as an asset in a merger, acquisition or bankruptcy, provided the recipient honors the notice given at collection.
The service provider carve-out is the one businesses lean on most, and it only holds if the contract contains the required restrictions and the vendor actually stays inside them. A vendor that uses the data to build its own products has stepped outside the role, and the disclosure to it becomes a sale.
What counts as sharing?
Sharing was added by the CPRA amendments and has a single purpose: to capture behavioral advertising regardless of payment. It means disclosing, making available or otherwise communicating a consumer's personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.
Cross-context behavioral advertising is advertising targeted to a consumer based on personal information obtained from the consumer's activity across businesses, websites, applications or services other than the one the consumer is currently interacting with. Two consequences follow:
- Advertising within your own properties is not sharing. Personalization based only on the consumer's activity on your own site or app - sometimes called first-party advertising - falls outside the definition.
- Contextual advertising is not sharing. Serving an ad based on the content of the page, without using personal information about the individual gathered elsewhere, is not covered.
The exclusions that apply to sales apply here too, including the service provider and contractor carve-out and the consumer-directed disclosure.
Sale vs sharing vs service provider disclosure
| Sale | Sharing | Disclosure to a service provider | |
|---|---|---|---|
| Recipient | Third party | Third party | Service provider or contractor |
| Consideration required? | Yes - monetary or other valuable consideration | No - covered whether or not anything is exchanged | Irrelevant; the vendor is normally paid by the business |
| Purpose | Any purpose | Only cross-context behavioral advertising | Limited to the specified business purpose in the contract |
| Consumer opt-out? | Yes | Yes | No - it is neither a sale nor sharing if the contract is compliant |
| Homepage link | Covered by the single "Do Not Sell or Share My Personal Information" link | Covered by the same single link | Not required on this basis |
| Opt-out preference signals | Must be honored | Must be honored | Not applicable |
| Minors | Opt-in required before selling the personal information of a consumer under 16; a parent or guardian consents for a consumer under 13 | The same opt-in requirement applies before sharing | Not applicable |
How do other states handle the same conduct?
California's two-concept structure is unusual. Most other states use a single definition of sale plus a separate opt-out right for targeted advertising, which between them reach roughly the same conduct as California's sale and sharing pair.
| Approach | Definition of sale | Separate targeted advertising opt-out? | Example states |
|---|---|---|---|
| Broad consideration | Monetary or other valuable consideration | Yes | California (plus the sharing concept), Colorado, Connecticut |
| Monetary only | Exchange for monetary consideration | Yes | Virginia, Utah |
| Narrowest | Exchange for monetary consideration | No standalone opt-out right; targeted advertising must be disclosed with a means to opt out | Iowa |
Because most non-California states carry a targeted advertising opt-out regardless of how they define sale, a program built around the California sharing concept usually maps onto them cleanly. The difference bites in the opposite direction: a business that decides it makes no "sales" because no money moves will still have opt-out obligations in most of these states.
Delivery of the opt-out also converges. California requires businesses to honor opt-out preference signals such as the Global Privacy Control, and several other states require recognition of a universal opt-out mechanism, so a browser-level signal has to be treated as a valid request rather than ignored in favor of a click-through form.
Related study notes
- Sale and California's Unique Sharing Regulation
- Opt-Out Rights - Sales, Targeted Advertising, Automated Decisions
- Universal Opt-Out Mechanisms and the Global Privacy Control
- Self-Regulation for Digital Advertising: DAA and NAI
- Digital Advertising Ethics: Behavioral Advertising, Dark Patterns and Children
Frequently asked questions
Is passing data to an ad network a sale or sharing?
It is usually both. If the ad network is a third party and the purpose is cross-context behavioral advertising, the disclosure is sharing whether or not the business is paid, and if there is monetary or other valuable consideration it is also a sale. Either way the consumer opt-out applies.
Do I have to post a Do Not Sell link if I do not take money for data?
Yes, if you disclose personal information to third parties for cross-context behavioral advertising. That is sharing, which is covered regardless of payment, and California allows a single Do Not Sell or Share My Personal Information link to cover both.
Is using analytics cookies on my own site a sale or sharing?
Not if the analytics vendor is a service provider under a compliant contract and the data is used only for your specified business purpose. It becomes a sale or sharing if the vendor is a third party using the data for its own purposes or for cross-context targeting.
Does the Global Privacy Control count as a valid opt-out?
In California, yes. Businesses must treat an opt-out preference signal such as the Global Privacy Control as a request to opt out of sale and sharing. Several other states also require recognition of a universal opt-out mechanism.
Test yourself
Try the free CIPP/US practice questions, or read the full CIPP/US study guide - free.