Sale of Personal Information

What is a sale of personal information?

In everyday speech, selling data means handing it over for money. California's privacy law uses a much wider meaning, and many US privacy policies are written around it.

Under the CCPA, "selling" covers renting, releasing, disclosing or otherwise making personal information available to a third party "for monetary or other valuable consideration." Valuable consideration means anything of value, not just cash. A free analytics report, better ad targeting or a data swap can count.

California's Attorney General showed how wide this is in its 2022 settlement with Sephora. Sephora let third-party tracking companies collect data from its website and apps. The Attorney General said this arrangement "constituted a sale" under the CCPA, and Sephora paid $1.2 million in penalties. As the Attorney General's complaint explains, Sephora got analytics and ad targeting in return, and that was enough.

Some transfers are not a sale under the statute:

• Disclosures the person asks for, such as connecting two apps on purpose.
• Handing data to a service provider that is under a contract to use it only to serve the business.
• Transfers in a merger or acquisition. If the buyer later wants to use the data in a way that is materially different from what people were promised, it must tell them first.

The CCPA also has a related word, "sharing," which means giving data to others for cross-context behavioral advertising. It applies whether or not anything of value changes hands. See selling vs sharing data and targeted advertising.

What it looks like in a vendor's terms

A typical clause reads like this:

We do not sell your personal information for money. We may share information about your use of our websites with advertising and analytics partners. Under some state laws, this may be considered a "sale" or "sharing" of personal information. You can opt out using the link at the bottom of our website.

• "Not for money": this denies only the narrow meaning. It does not rule out a sale under the CCPA's wider definition.
• "Advertising and analytics partners": companies that may get your data through cookies or pixels.
• "May be considered a sale": the vendor accepts that the law may treat this as selling.
• "Opt out": your right under the CCPA to tell the business to stop.

Some vendors say this plainly. HubSpot's privacy policy says it has "'sold' or 'shared' certain information, including identifiers, to our advertising partners."

A real change we caught

Venpo flagged this change: Zoom now says it may sell business contact data. Its current privacy statement, last updated September 17, 2026, says "Sales of business contact related data may occur" in connection with its Common Room offering.

Why it matters to you

• Your customers' data may travel further than you think. If a vendor sells or shares the personal data it collects through your use of the product, your users can end up in other companies' databases.
• Your own privacy promises. If you tell your customers you never sell their data, a vendor that sells data it gets from you can make that promise untrue.
• Contract status. A vendor that acts as a service provider must be under a contract that bars it from selling or sharing your data. If it sells, it may not qualify, and you may be treated as the one selling.
• Opt-out duties. If your own website lets ad and analytics tools collect visitor data, you may be the one making a sale, with a duty to offer an opt-out and honor Global Privacy Control signals.

What to check

• Search the privacy policy for "sell," "sale" and "share." Read the full sentence each time, including any "for money" qualifier.
• Check the state law section, often titled "Your California privacy rights" or "US state disclosures," for the categories of data sold or shared in the last 12 months.
• Check the DPA or service provider terms for a promise not to sell or share data the vendor processes for you.
• Look for a "Do Not Sell or Share" or "Your Privacy Choices" link on the vendor's website.
• Compare against the last version you saved, since a promise that disappears matters as much as a new disclosure.

"We Do Not Sell Your Data" Statement

"We do not sell your data" is a promise many vendors put in their privacy policy or on their pricing or security pages. It sounds simple, but the meaning depends on how the vendor defines "sell."

If it means only "for money," data can still go to ad or analytics partners in exchange for something else of value. Under the CCPA that can still be a sale, as the Sephora case showed. The statement also may not cover "sharing" for cross-context advertising, which is a separate term under the law.

Ask whether it says "sell" or "sell or share," whether it is limited to "for money," and whether it covers all your data or only one product.

When the sentence disappears, treat that as a real change. It may mean the vendor now sells or shares some data, or that it rewrote the policy for another reason. You cannot tell from the removal alone. Ask the vendor in writing whether its practice changed, and check whether your DPA still bars selling your data.

"Do Not Sell or Share" Link

The "Do Not Sell or Share My Personal Information" link is the opt-out link the CCPA requires from businesses that sell or share personal information. The statute says the link must be clear and conspicuous on the homepage and lead to a page where people can opt out. The business may not make people create an account to use it.

The CPPA regulations add details. The link goes in the header or footer of the homepage. A business may instead use one combined link titled "Your Privacy Choices" or "Your California Privacy Choices," with an opt-out icon. A business that honors opt-out preference signals in the required way, without fees or pop-ups, does not have to post the link.

A vendor with this link is telling you it sells or shares some personal information. Find out which data, and whether any of it comes from your account.

How Venpo helps

The Fine Print Scan answers whether each vendor sells your data or uses it for ads. Venpo also watches vendors' privacy policies and other public legal pages, and emails you a plain-English alert when sale or sharing language is added or removed.