Am I “Selling” Data If No Money Changes Hands?
I have never sold a customer list. The idea would horrify me. I do run analytics, and I do have an advertising pixel on my marketing site, because everyone does.
I have always assumed that means I am in the clear. I have never actually checked what California’s definition of “selling” data covers, or whether it agrees with me.
How Does California Law Define a Sale?
Under Civil Code Section 1798.140, to Sell means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s personal information to a third party for monetary or other valuable consideration.
The final phrase is the one that matters. Consideration need not be cash. Making user data available to an advertising network in exchange for better targeting can fall inside the definition even though no invoice is ever generated.
What Does “Sharing” Add?
The statute defines Share separately, covering disclosure of personal information to a third party for Cross-Context Behavioral Advertising, which the same section defines as targeting advertising to a consumer based on their personal information obtained from activity across businesses, websites, applications, or services other than your own.
That is a precise description of retargeting. If you run it, the sharing analysis applies to you whether or not the sale analysis does.
What Actually Decides the Answer?
The distinction that matters most in practice is between a third party and a Service Provider. A service provider processes personal information on your behalf, for your purposes, under contractual restrictions limiting what it may do with the data. Disclosures to a properly contracted service provider are treated differently from disclosures to a third party acting for its own purposes.
Which one a vendor is depends heavily on your contract with them. The same pixel on the same page can produce different characterizations depending on the terms governing the relationship. Large advertising platforms in particular often operate under terms permitting use of the data for their own purposes, and you generally cannot change that by preferring otherwise.
Note also that the obligation attaches to categories of activity rather than to intent. A company can be well inside scope without ever having made a decision it would describe as selling data.
Common Mistakes Founders Make
- Answering from the ordinary meaning of the word. “We do not sell data” is nearly always true colloquially and frequently wrong as a legal conclusion. The definition governs, not the intuition.
- Assuming every vendor is a service provider. Status depends on contractual restrictions on the vendor’s own use of the data.
- Adding the opt-out link without wiring anything behind it. A link producing no change in data flows is worse than none, because it represents a capability to consumers that you do not have.
A Quick Founder Check
- Can we list every third-party script, pixel, SDK, and tag running on our site and in our product?
- For each, do we have a contract restricting the vendor to processing on our behalf?
- Which vendors may use the data for their own purposes?
- Do we run retargeting, and has anyone assessed it against the sharing definition?
- If a user opted out today, what would actually change in our data flows?
- Have we answered a customer questionnaire on this, and would we answer the same way now?
- Who would know if a new tracking tag were added next week?
The Bottom Line
This analysis runs vendor by vendor and contract by contract, which makes it tedious but finite. Most companies finish it in a day and are surprised by exactly one relationship, usually an advertising integration installed by someone acting entirely in good faith.
Download the Data Mapping Worksheet to build your vendor and tag inventory, which is the necessary first step in this analysis: https://primumlaw.com/primumlawgroup/data-mapping-worksheet/