Sale of personal information
Under the California Consumer Privacy Act, a sale of personal information is any disclosure or making available of a consumer's personal information to a third party for money or other valuable consideration, which covers many advertising and analytics tags.Cal. Civ. Code 1798.140(ad) defines selling as renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration. No payment is needed: access to an advertising network's services, audiences or measurement in exchange for the data can be valuable consideration. Since the CPRA amendments, a separate term in 1798.140(ah) covers sharing, meaning disclosure to a third party for cross-context behavioral advertising, whether or not anything of value is exchanged.
Some transfers fall outside it: disclosures the consumer directs, transfers in a merger or acquisition, and disclosures to service providers or contractors bound by a contract that limits their use of the data, which the law does not treat as third parties. That is why the same tool can be a sale on one site and not on another, depending on its terms and configuration.
The consequence is the opt-out. Businesses that sell or share must offer a "Do Not Sell or Share My Personal Information" link and honor Global Privacy Control. The California Attorney General's 2022 settlement with Sephora, for $1.2 million, was the first public CCPA enforcement on this point: it treated third-party tracking on the website as a sale. See the CCPA and CPRA page and the Do Not Sell link.