skip to content

Sale & Sharing Opt-Outs

4 roadmaps6 questions

The definitions of sale and sharing are broad enough to cover ordinary ad-tech tags, which is why the opt-out link and honoring the Global Privacy Control signal matter. Interviewers ask what makes a vendor a service provider instead, since that carve-out is how most sites stay compliant.

part ofCompliance & governance standardsoverview, primer and where to startread it →
on this pageshow

explore

questions

6

Under the CCPA as amended by the CPRA, what is the difference between 'selling' and 'sharing' personal information?

level: juniorimportance: must knowfreq 55%

answer

  1. both go to a third party
  2. one needs consideration
  3. the other needs a purpose
  4. cross-context behavioural advertising
  5. 1798.140(ad) and (ah)

basics

~20 s

Under Civil Code 1798.140, selling is making personal information available to a third party for monetary or other valuable consideration; sharing is making it available to a third party for cross-context behavioural advertising, whether or not anything is paid.

solid answer

~50 s

Both definitions in Civil Code `1798.140` cover any way of making a consumer's personal information available to a **third party**. A **sale** (`(ad)`) is defined by the exchange: monetary or other valuable consideration. **Sharing** (`(ah)`) is defined by the purpose: **cross-context behavioural advertising**, 'whether or not for monetary or other valuable consideration'. Cross-context behavioural advertising (`(k)`) means targeting ads using personal information from the consumer's activity across other businesses, sites, apps or services than the one they intentionally interact with. So a news site whose ad-tech tags let another company follow readers and target them elsewhere is sharing even if no money moves, and selling as well if it gets paid or receives something of value. Neither covers disclosures to a service provider or contractor, which are not third parties, or the exclusions in `(ad)(2)` and `(ah)(2)`. Both trigger the same right to opt out in `1798.120`.

go deeper

for a junior

Recall that a sale needs money or other value and sharing needs cross-context behavioural advertising, with or without payment, and that both go to a third party.

for a middle

Explain cross-context behavioural advertising from 1798.140(k), the exclusions in (ad)(2) and (ah)(2), and why service providers are outside both definitions.

for a senior

Show you can classify a real tag inventory: which tags share, which also sell, which are service providers, and what evidence supports each call.

for a principal

Weigh the revenue of cross-context advertising against running every tag through opt-out gating, and decide where contextual advertising can replace it.

## Two definitions, one opt-out Under the CCPA as amended by the CPRA, the right to opt out in Civil Code `1798.120` applies to a business that **sells or shares** personal information. The two verbs are defined separately in `1798.140`, and the line between them is the whole question. ## Sale `1798.140(ad)(1)`: 'selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating ... a consumer's personal information by the business to a **third party** for **monetary or other valuable consideration**'. - The recipient must be a **third party**. - The disclosure must be **for consideration**; 'other valuable consideration' means the exchange need not be cash. ## Sharing and cross-context behavioural advertising `1798.140(ah)(1)`: the same list of verbs, to a **third party** 'for **cross-context behavioral advertising**, whether or not for monetary or other valuable consideration, including transactions ... in which no money is exchanged'. `1798.140(k)` defines **cross-context behavioural advertising** as targeting advertising to a consumer based on personal information obtained from the consumer's activity **across** businesses, distinctly branded websites, applications or services, **other than** the one the consumer intentionally interacts with. ## Side by side | | Sale | Sharing | |---|---|---| | Civil Code | `1798.140(ad)` | `1798.140(ah)` | | Recipient | Third party | Third party | | What defines it | Monetary or other valuable consideration | Purpose: cross-context behavioural advertising | | Payment needed? | Yes, money or other value | No | | Opt-out right | `1798.120` | `1798.120` | A single data flow can be both: an ad-tech partner that pays the site for audience data it then uses to target those readers elsewhere receives it for consideration and for cross-context behavioural advertising. ## What is neither - **Disclosures to a service provider or contractor.** 'Third party' in `1798.140(ai)` excludes them, so a compliant vendor relationship is outside both definitions; what makes a vendor qualify is its own question. - **Consumer-directed disclosures.** Where the consumer uses or directs the business to intentionally disclose information or interact with a third party (`(ad)(2)(A)`, `(ah)(2)(A)`). - **Opt-out identifiers.** Using or sharing an identifier for an opted-out consumer solely to tell others about the opt-out (`(ad)(2)(B)`, `(ah)(2)(B)`). - **Corporate transactions.** Transfers as an asset in a merger, acquisition or bankruptcy where the acquirer uses the data consistently with the title (`(ad)(2)(C)`, `(ah)(2)(C)`). - **Contextual and first-party advertising.** Ads chosen from the page being read, or nonpersonalised ads based on the current interaction, do not use activity across other contexts. ## The news website A news site carries third-party ad-tech tags. For each tag, ask two questions: 1. **Does the tag's owner receive readers' personal information (identifiers, page views) and use it, or let others use it, to target those readers on other sites and apps?** If yes, the site is **sharing**, paid or not. 2. **Does the site receive money or other value for letting the tag collect that data?** If yes, and the owner is a third party, it is also **selling**. A tag from a vendor that only measures the site's own audience for the site, under a compliant service-provider contract, is neither; the same vendor using the data to build profiles it sells to others is a third party. ## Why it matters in practice The classification drives everything downstream: whether the site needs the opt-out link or equivalent, which tags must fire differently for opted-out readers, and what the privacy policy must say. The common interview mistake is to answer 'we do not sell data because nobody pays us for it', which ignores sharing entirely.

  • Is a contextual ad placed next to a recipe article 'sharing' under the CCPA?
    Not if it is chosen from the page's content rather than from the reader's activity elsewhere. Cross-context behavioural advertising in Civil Code 1798.140(k) requires targeting based on activity across other businesses, sites, apps or services. The CCPA regulations give contextual advertising as a service a service provider may perform for a business.
  • Does a merger that transfers the customer database count as a sale?
    Not if the acquirer uses the personal information consistently with the title. Civil Code 1798.140(ad)(2)(C) and (ah)(2)(C) exclude transfers as an asset in a merger, acquisition or bankruptcy, but a third party that later materially changes its use inconsistently with the promises made at collection must give consumers prior notice.

saying these in an interview costs you the question

  • Says nothing is sold or shared if no money changes hands
  • Thinks sharing, like a sale, requires payment
  • Treats every disclosure to any vendor as a sale
  • Believes contextual ads on a page are cross-context behavioural advertising
  • Assumes sale and sharing carry two different opt-out rights
open as a page

Under the CCPA, what makes an advertising or analytics vendor a service provider rather than a third party, and why can't cross-context advertising qualify?

level: seniorimportance: must knowfreq 46%

basics

~20 s

Under Civil Code 1798.140(ag), a service provider processes personal information for a business purpose under a written contract barring sale, sharing and other uses; 11 CCR 7050(b) makes a vendor providing cross-context behavioural advertising a third party.

open as a page

Under the CCPA, a retail app sends users' precise location to an ad network — what does the right to limit sensitive personal information add?

level: middleimportance: should knowfreq 38%

basics

~20 s

Precise geolocation is sensitive personal information under Civil Code 1798.140(ae), so besides the opt-out of sharing, 1798.121 lets users limit its use to what an average consumer expects for the service and other permitted purposes.

open as a page

Under the CCPA, when may a business sell or share a minor's personal information, and who authorises it for under-13s and 13-to-15-year-olds?

level: middleimportance: should knowfreq 30%

basics

~20 s

Under Civil Code 1798.120(c), a business with actual knowledge a consumer is under 16 may not sell or share their data unless affirmatively authorised: by the consumer at 13 to 15, by a parent or guardian under 13.

open as a page

Under the CCPA regulations, a logged-out visitor's browser sends an opt-out preference signal to a news site — what must the site do, and to what does it apply?

level: seniorimportance: should knowfreq 40%

basics

~20 s

Under 11 CCR 7025, a site that sells or shares must treat a valid signal as an opt-out for that browser or device and any profile tied to it, pseudonymous ones included, and for the person once known.

open as a page