Sharing Personal Information

Under CPRA, sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. This definition was added to CPRA to capture practices not meeting CCPA's 'sale' definition but still enabling behavioral advertising across different business contexts. For example, allowing advertising platforms to track users across publisher websites constitutes 'sharing' even if the publisher isn't paid directly. Businesses sharing personal information must: provide 'Do Not Share My Personal Information' mechanisms, honor opt-out requests within 15 business days, recognize universal opt-out signals like Global Privacy Control, and obtain opt-in consent before sharing data of consumers under 16. CPRA's sharing provisions close perceived CCPA loopholes where companies argued they weren't 'selling' data even though they enabled extensive behavioral tracking. Organizations should assess whether their advertising practices constitute sharing and implement appropriate opt-out mechanisms alongside sale opt-outs.