The Broad CCPA Definition of Sale
The definition of sale in the CCPA is crucial for covered businesses to understand as they develop their compliance efforts. It is at the heart of the disclosures that will be made about an organization’s privacy practices, the terms of the contracts a business needs to have in place with its service providers, and the company’s consent management efforts around the right to opt out and Do Not Sell My Personal Information link.
Let us start with the text of the definition from Section 1798.140(t)(1) of the California Consumer Privacy Act:
“Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
To discuss a few of the relevant sections of the definition:
“business or a third party” – This extends to both covered businesses that did not originally collect the personal information from the consumer as well third parties, a catch-all term for any recipient of personal information from a business that is not a transfer pursuant to the service provider exemption. The definition of third party lists a few different requirements, including that it (1) occur for a business purpose and (2) pursuant to a written contract that contains the specified three prohibitions around the personal information as well as the required certification by the person receiving the personal information.
“monetary or other valuable consideration” – This appears to cover both personal information provided in exchange for money, the classic definition of the term sale, as well as other exchanges such as the swapping of services for the data. Until the Attorney General issues regulations that indicate otherwise, most sharing of personal information with another entity
“disclosing, … making available, transferring or otherwise communicating” – The string of terms to cover the sharing of personal information to another person or organization seems like an attempt to ensure that it is as broad as possible and covers any disclosure by a business to another organization, regardless of form.
Why is the Definition of Sale so Important?
Right to Opt-Out and Opt-In – The ability to prohibit a business from selling their personal information is one of the two core segments of rights given to consumers by the CCPA (the other being the right to access and delete their personal information). A business needs to understand who they sell personal information to in order to (a) ensure they have stopped selling data to them about children 15 years of age or younger without consent, and (b) allow adults 16 years of age or older to opt-out of these data sales.
Vendor Management – For a business to ensure that its vendors qualify for the service provider exemption and it can continue sharing personal information with them, it either needs to conclude that it is not selling personal information to them or it needs to enter into an appropriate contract to qualify them as a service provider. Given the anticipated breadth of the term sale, it is expected that most businesses will need to revise their contracts with their vendors.
Privacy Disclosures – The CCPA requires covered businesses selling personal information to make certain disclosures before and after receiving a verified consumer request. It also requires certain disclosures by businesses that disclose a consumer’s personal information for a business purpose. At the heart of these disclosures is correctly interpreting whether a business is selling personal information, or not.
GET OUR FREE WHITE PAPER ON THE NEW CALIFORNIA LAW:
Additional Resources:
CCPA Summary
Data Portability for CCPA DSAR Access Responses
What is a CCPA business purpose or commercial purpose?
CCPA Definition of Consumer
CCPA Look Back Period Requirement
CCPA Household Definition & Challenges
CCPA Training Requirement – Section 1798.130(a)(6)
CCPA Regulations: Coming Soon from the California Attorney General
Loyalty Programs, AB-846, and the CCPA Anti-Discrimination Clause