Selling vs Sharing Data (CCPA)

The short answer

Both are ways a business passes personal information to a third party, and California residents can opt out of both. A sale is about getting something of value in return. Sharing is about targeted advertising across sites and apps, even when nothing is paid.

That is why a vendor can truthfully say it does not "sell" data and still "share" it, for example through ad pixels and cookies on its website.

Selling personal information

• The legal meaning: making personal information available "to a third party for monetary or other valuable consideration" (Cal. Civ. Code 1798.140(ad)). "Valuable consideration" means it can count as a sale without cash, for example data in exchange for data or services.
• Who it binds: businesses covered by the CCPA. The California Privacy Protection Agency lists the thresholds, such as gross annual revenue of $26.625 million or more (the figure in effect since January 1, 2025), or buying, selling or sharing the personal information of 100,000 or more California residents or households.
• What is not a sale: the agency notes that a disclosure made at the consumer's own direction is not a sale. A sale is a disclosure to a "third party." A service provider, which processes personal information on a business's behalf under a written contract, is defined separately (1798.140(ag)).

See also sale of personal information.

Sharing personal information

• The legal meaning: making personal information available "to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration" (1798.140(ah)).
• Cross-context behavioral advertising: targeting ads based on personal information from a person's activity across other businesses, websites, apps or services than the one they are using (1798.140(k)).
• Common example: a tracking pixel from an ad platform on a vendor's website that lets the platform show visitors ads elsewhere.

Which one applies to you

As a consumer in California, you have the right to tell a business that sells or shares your personal information to stop. The law calls this "the right to opt out of sale or sharing" (1798.120(a)). Businesses must also honor opt-out preference signals such as Global Privacy Control, a browser setting (CPPA FAQ).

As a business buying SaaS, the question is what your vendor does with data about your team and about your customers. Read the vendor's privacy policy for both words, "sell" and "share," because a vendor may deny one and admit the other.

• Your customer data in the product: if the vendor acts as your service provider, its contract should limit how it uses that data. If its privacy policy says it may sell or share customer data, ask how that fits your contract.
• Data about your staff and website visits: the vendor handles this as its own business. Its privacy policy will say whether it sells or shares it.
• Your own website: if you put a vendor's ad pixel on your site, you may be the one sharing. Check how your own opt-out link and GPC handling work, and list every ad tag on your site.

Example

A sale example Venpo caught: Zoom now says it may sell business contact data. Zoom narrowed its line "We do not sell your personal data" to data covered by its main privacy statement, and added that sales of business contact data may occur through Zoom Common Room. That is passing data on for value, which is what the CCPA calls a sale.

A sharing example Venpo caught: Uber now says its ad partners may combine your data with other sources. Uber's cookie notice now also says that in some places this ad sharing "may be considered a 'sale' or 'sharing'" under the law, and points to its opt-out choices. That is the sale and sharing line this page describes, drawn by the vendor itself.

How Venpo helps

One of the Fine Print Scan's four questions is whether each vendor sells your data or uses it for ads. Venpo also monitors vendors' privacy policies and cookie policies and emails a plain-English alert when the wording on selling, sharing or advertising changes.