Is licensing data to an AI lab a sale under CCPA?
The short answer
Under Civil Code 1798.140(ad)(1), a transfer of personal information for monetary or other valuable consideration is a sale. Two exits exist: a third party that assumes control of the business, or data that meets the deidentified definition. The text does not mention AI labs. Ask counsel about any deal.
The California Consumer Privacy Act reaches employee and business-contact data as well as consumer data. That surprises people, so I'm putting it first.
What does the CCPA's definition of sale say?
The CCPA's section 1798.140(ad)(1) defines sell with a long list of verbs: selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating.
The target is a consumer's personal information. It is passed to a third party for money or other valuable consideration. The wording is broad enough to reach a license.
Section 1798.190 adds an anti-avoidance rule. A court or the agency must ignore steps taken to avoid the definition of sell. That includes steps that drop the money while a party still gets something of value.
Does the merger exception cover a data license?
The exception in (ad)(2)(C) covers personal information transferred "as an asset that is part of a merger, acquisition, bankruptcy, or other transaction." The third party must take control of all or part of the business.
A license to a lab leaves the owner in control of its business. On the text, that points away from the exception. That is a reading. It is not a court ruling.
Does de-identifying the data avoid the sale rule?
Only if the data meets the definition. Under 1798.140(m), the data cannot reasonably be used to learn facts about a consumer. It cannot be linked to one either. The business must also meet three conditions.
- It takes reasonable steps so the information cannot be tied to a consumer or household.
- It publicly commits to keep it deidentified and not to re-identify it.
- It requires every recipient by contract to follow the same rules.
Does CCPA cover employee data in a sale?
The California Attorney General says the employment and business-to-business exemptions expired. Employee and B2B personal information has been covered since 1 January 2023.
What does a sale require afterward?
A business that sells personal information must sign an agreement with the buyer. The agreement does four things:
- It limits the purposes.
- It requires the same level of privacy protection.
- It gives the business steps to check compliance.
- It requires the buyer to report if it cannot comply.
It also lets the business stop and fix unauthorized use. That is Civil Code 1798.100(d).
The fines are real. The Attorney General announced $12.75 million from General Motors on 8 May 2026 for selling driving data to buyers against its privacy policy. See the risks page for the full table and the privacy policy page for the notice side.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
