Sale of Personal Information

Under CCPA Section 1798.140(ad), the sale, rental, release, disclosure, dissemination, making available, transfer, or other oral or written communication of personal information by the business to a third party for monetary or other valuable consideration. This definition is notably broad—'valuable consideration' extends beyond direct payments to include data exchanges, advertising benefits, and other value transfers. Key aspects: businesses selling personal information must provide 'Do Not Sell' links, honor opt-out requests within 15 days, and obtain opt-in consent for consumers under 16. CPRA amendments exclude certain activities from 'sale' definitions, including disclosures to service providers/contractors under qualifying agreements, consumer-directed disclosures, and certain contextual advertising. 'Valuable consideration' has generated debate—regulators have clarified that simply embedding third-party analytics doesn't constitute a sale, but sharing data to receive advertising services likely does. Organizations should carefully analyze whether their data practices constitute sales under this expansive definition.