Do You "Sell" Personal Information?

Privacy laws defines sale broadly, covering transactions that businesses often don’t even think about.

For example, the CCPA's definition of selling is:

"Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration."

Disclosing personal information with a third party for monetary consideration is the most obvious example. If a business exchanges consumers’ email addresses for money, few would argue that this is not a sale.

It’s the last phrase—“or other valuable consideration”—that is of key importance. This covers a variety of information transactions for which businesses do not receive any money. For example, giving access to your customers' personal information in exchange for free or discounted software, or in exchange for access to personal information from other businesses (a "data co-op") would likely be considered selling.

When a transfer of information is considered a sale, the most important consequence is that it is covered by consumers’ right to opt-out, covered in more detail below.

What Is Not a Sale?

There are a few key categories of transactions that are not considered a sale of personal information. Disclosing consumer data to a third party is not a sale when:

  • A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information
  • The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose


Google’s Restricted Data Processing Google allows users to turn on “restricted data processing” for various advertising and analytics services that do not already operate under restricted data processing. If you turn on restricted data processing in accordance with Google’s instructions, certain uses of PI collected by Google will be disabled for advertising purposes, such as profile-building. If you enable restricted data processing with your Google services, your use of Google advertising and other services may not be considered a sale of PI. If you have questions about your particular use of Google’s services, you can reach out to Google. You can learn more about restricted data processing here.

Facebook’s Limited Data Use

Facebook allows users to enable a similar data processing mode called “limited data use” that restricts how it uses and shares PI. If you enable limited data use for services you receive from Facebook, such as Facebook ads, your use of Facebook advertising may not be considered a sale of PI. If you have questions about your particular use of Facebook’s services, you can reach out to Facebook. You can learn more about limited data use here.


This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.