Introduction

The California Consumer Privacy Act (CCPA) has a broad definition of what constitutes a sale of personal information. It’s not just about selling data for money — any transfer of personal data for value can count as a sale under CCPA.

Understanding what counts as a CCPA sale is key for any business handling personal data of California residents.

What Does ‘Sale’ Mean Under CCPA?

Under the CCPA, “sale” of personal information is defined as:

“selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to another business or a third party for monetary or other valuable consideration.”

In simpler terms:

A sale under CCPA occurs when personal data is shared with a third party in exchange for money or some other benefit, such as advertising exposure or audience insights.

Key Elements That Define a CCPA Sale:

1. Exchange of Personal Information

A sale under CCPA includes:

• Selling
• Renting
• Disclosing
• Transferring or
• Making personal information available

These apply even if done electronically, verbally, or via software platforms.

2. Valuable Consideration

A CCPA sale doesn’t have to involve cash.
If your business shares data in exchange for benefits like

• Targeted advertising
• Analytics services
• insights
• Expanded audience reach

…it may be considered a sale under the law. This is known as “valuable consideration.”

3. Third-Party Data Sharing

If personal data is shared with a third party that:

• Is not a service provider
• Is not bound by a CCPA-compliant contract

…then it’s typically classified as a sale.

Examples of What May Be Considered a Sale:

• Selling customer email lists to advertisers
• Sharing browsing or behavioral data with ad networks
• Exchanging personal information for analytics tools or AI model training

These are examples of CCPA data transfers that could trigger opt-out requirements.

What Is Not Considered a Sale Under CCPA?

Not every transfer of personal information qualifies as a sale. Key exceptions include:

• Sharing with service providers under a valid CCPA agreement
• Legal disclosures, such as those required by law enforcement
• Consumer-directed disclosures, where the user chooses to interact with third-party features (e.g., social media buttons or embedded widgets)

These do not require an opt-out under the CCPA.

CCPA Opt-Out Requirements for Businesses:

If your business engages in personal data sales under CCPA, you must allow consumers to opt out.

Your business must:

• Display a “Do Not Sell My Personal Information” link on your website
• Provide an easy-to-use CCPA opt-out form
• Honor opt-out preference signals (if applicable under CPRA)

⚙️ Mandatly’s CCPA compliance software makes it simple to deploy a compliant, user-friendly opt-out mechanism on your site.