CIPP/US Study Guide
Chapter 6: State Comprehensive Privacy Laws

Sale and California's Unique Sharing Regulation

Last reviewed:

Each state regulates the sale of personal data, but the definition splits: Utah and Virginia limit sale to monetary compensation, while California, Colorado, and Connecticut include any exchange for value (bartering). Only California separately regulates sharing for cross-context behavioral advertising.

How 'sale' is defined
Scope of saleStates
Monetary compensation onlyUtah, Virginia
Monetary compensation OR bartering (any exchange for value)California, Colorado, Connecticut

Common exclusions from sale include disclosures to a processor, disclosures to a third party to provide a consumer-requested product/service, consumer-directed disclosures, and asset transfers in a merger, acquisition, or bankruptcy.

Only California regulates sharing

California uniquely regulates sharing - transferring personal information to a third party for cross-context behavioral advertising, whether or not for consideration. Colorado, Connecticut, Utah, and Virginia do not explicitly regulate sharing.

Key terms - quick answers

What is “Sale”?
A regulated transfer of personal data; defined narrowly (monetary only) in Utah and Virginia, and broadly (any exchange for value) in California, Colorado, and Connecticut.
What is “Sharing”?
California's separately defined activity of transferring personal information to a third party for cross-context behavioral advertising, whether or not for consideration.
What is “Cross-context behavioral advertising”?
Advertising targeted to a consumer based on personal information collected over time across different online contexts.

Keep going - free

Every study note on this site is free. So are these: