Selling Personal Information

Under CCPA/CPRA, selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information to a third party for monetary or other valuable consideration. This broad definition extends beyond traditional sales to include indirect value exchanges. For example, allowing third parties to collect consumer data through website tags in exchange for analytics or advertising services may constitute selling even without direct payment. Key compliance requirements for businesses that sell: provide clear 'Do Not Sell My Personal Information' links, honor opt-out requests within 15 business days, obtain opt-in consent for consumers under 16, not request opt-in for 12 months after opt-out, and contractually prohibit third parties from selling the data further. CPRA added 'sharing' to capture cross-context behavioral advertising not meeting the 'sale' definition. Organizations should carefully assess whether their data practices constitute selling, implement compliant opt-out mechanisms, maintain records of sales and opt-outs, and establish processes preventing sales of minors' data without appropriate consent.