What counts as a "sale"
The CCPA defines selling as making a consumer's personal information available to a third party "for monetary or other valuable consideration" (§1798.140(ad)). A paid AI data license that includes personal information can fit that wording.
Who counts as a "consumer"
Any natural person who is a California resident. That includes your employees, job applicants and business contacts. Their temporary exemptions expired January 1, 2023.
The de-identification test
Data that is properly "deidentified" falls outside the definition of personal information. The statute requires all three (§1798.140(m)):
- Reasonable measures so the data can't be linked to a person or household
- A public commitment not to re-identify it
- Contracts that require every recipient to follow the same rules
Ask any buyer whether its contract includes the recipient commitments. See how to anonymize company data.
New risk-assessment rules
California's privacy agency finalized rules that require a risk assessment before selling or sharing personal information. Compliance began January 1, 2026 (White & Case).
Does the CCPA apply to your company?
It covers for-profit businesses that meet thresholds such as annual revenue above $26,625,000 (2025 adjusted figure) or that buy, sell or share personal information of 100,000+ consumers or households, among other tests. Check the current thresholds with counsel.
CCPA checklist for a data deal
- Map where California personal information sits in the dataset.
- Remove it, or de-identify to the statutory standard.
- Confirm the buyer's public no-re-identification commitment.
- Flow the commitment down to every downstream recipient by contract.
- Update your privacy notice if you'll sell any personal information.
- Complete a risk assessment where required.
Frequently asked questions
Does licensing data to AI count as a sale under the CCPA?
It can, if the data includes personal information of California residents and you receive money or other value. Properly de-identified data falls outside the definition.
Are employees covered by the CCPA?
Yes. The employee and B2B exemptions expired January 1, 2023, so employees and business contacts who are California residents are consumers.