Is it legal to license customer data?
The short answer
The sale itself is the regulated act. California's CCPA requires notice, opt-out and a written contract with the buyer. Penalties have followed sales that contradicted customer notices. California settled with General Motors for $12.75 million over driving data. Ask a lawyer to read your notices first.
Short version: the sale is the regulated act. The notice you gave your customers is the benchmark.
How does the CCPA treat a sale of customer data?
The statute defines a sale as disclosing personal information to a third party for "monetary or other valuable consideration." A business that sells must give notice and honor opt-outs.
It must also sign a contract with the buyer. The contract limits the purposes. It also requires the same protection (section 1798.100(d)). The statute tells courts to "disregard the intermediate steps" of deals built to avoid the word sale.
What happened when companies broke their customer data promises?
General Motors paid $12.75 million in civil penalties. The attorney general said GM sold location and driving data to two data brokers. It covered hundreds of thousands of Californians. GM also misled consumers about how the data was used, the attorney general said.
The orders bar selling driving data to consumer reporting agencies for five years. They require deletion within 180 days, with limited exceptions.
DoorDash paid $375,000. The attorney general said DoorDash took part in a marketing cooperative that shared customers' names, addresses and transaction histories. That was a sale, made without the required notice and opt-out.
Does calling it a license change anything?
The CCPA's definition covers disclosing, making available or otherwise communicating personal information. The exchange must be for monetary or other valuable consideration. It does not turn on whether the contract says sale or license.
On that text, a data license to an AI buyer can fit the definition. The exception is data that meets the statute's test for deidentified information. Deidentified means it can no longer be tied to a person. Ask counsel whether your deal fits.
That test has three parts:
- reasonable measures
- a public commitment not to reidentify
- a contract binding every recipient to the same
Do other laws change the answer?
Yes. Virginia counts a sale only when personal data is exchanged for money.
Some data sits under sector rules. That includes health records, financial records, student records and children's data. One example is HIPAA's ban on selling protected health information without authorization (45 CFR 164.502(a)(5)(ii)).
The role you held matters too. Did you collect the data as the owner, or hold it as a vendor for someone else? See SaaS vendors.
Talk to a privacy or commercial lawyer in your state before you sign. Our risks page and rights check list what to bring.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
