Do You "Sell" Personal Information?

Privacy laws defines sale broadly, covering transactions that businesses often don’t even think about.

For example, the CCPA's definition of selling is:

"Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration."

Disclosing personal information with a third party for monetary consideration is the most obvious example. If a business exchanges consumers’ email addresses for money, few would argue that this is not a sale.

It’s the last phrase—“or other valuable consideration”—that is of key importance. This covers a variety of information transactions for which businesses do not receive any money. For example, giving access to your customers' personal information in exchange for free or discounted software, or in exchange for access to personal information from other businesses (a "data co-op") would likely be considered selling.

When a transfer of information is considered a sale, the most important consequence is that it is covered by consumers’ right to opt-out, covered in more detail below.

What Is Not a Sale?

There are a few key categories of transactions that are not considered a sale of personal information. Disclosing consumer data to a third party is not a sale when:

• A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information
• The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose