# Is licensing data to an AI lab a sale under CCPA?

> Searching whether selling data to an AI lab is a CCPA sale? A license can be one. The statute counts transfers for money or other valuable consideration.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/is-selling-data-to-an-ai-lab-a-sale-under-ccpa  
Published: 2026-07-15  
Updated: 2026-10-14

## The short answer

Under Civil Code 1798.140(ad)(1), a transfer of personal information for monetary or other valuable consideration is a sale. Two exits exist: a third party that assumes control of the business, or data that meets the deidentified definition. The text does not mention AI labs. Ask counsel about any deal.

The California Consumer Privacy Act reaches employee and business-contact data as well as consumer data. That surprises people, so I'm putting it first.

## What does the CCPA's definition of sale say?

The CCPA's [section 1798.140(ad)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) defines sell with a long list of verbs: selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating.

The target is a consumer's personal information. It is passed to a third party for money or other valuable consideration. The wording is broad enough to reach a license.

[Section 1798.190](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf) adds an anti-avoidance rule. A court or the agency must ignore steps taken to avoid the definition of sell. That includes steps that drop the money while a party still gets something of value.

## Does the merger exception cover a data license?

The exception in (ad)(2)(C) covers personal information transferred "as an asset that is part of a merger, acquisition, bankruptcy, or other transaction." The third party must take control of all or part of the business.

A license to a lab leaves the owner in control of its business. On the text, that points away from the exception. That is a reading. It is not a court ruling.

## Does de-identifying the data avoid the sale rule?

Only if the data meets the definition. Under [1798.140(m)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), the data cannot reasonably be used to learn facts about a consumer. It cannot be linked to one either. The business must also meet three conditions.

- It takes reasonable steps so the information cannot be tied to a consumer or household.
- It publicly commits to keep it deidentified and not to re-identify it.
- It requires every recipient by contract to follow the same rules.

## Does CCPA cover employee data in a sale?

The [California Attorney General](https://oag.ca.gov/privacy/ccpa) says the employment and business-to-business exemptions expired. Employee and B2B personal information has been covered since 1 January 2023.

## What does a sale require afterward?

A business that sells personal information must sign an agreement with the buyer. The agreement does four things:

- It limits the purposes.
- It requires the same level of privacy protection.
- It gives the business steps to check compliance.
- It requires the buyer to report if it cannot comply.

It also lets the business stop and fix unauthorized use. That is [Civil Code 1798.100(d)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf).

The fines are real. The [Attorney General announced](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general) $12.75 million from General Motors on 8 May 2026 for selling driving data to buyers against its privacy policy. See the [risks page](/risks) for the full table and the [privacy policy page](/answers/do-i-need-to-update-my-privacy-policy-before-licensing-data-to-ai) for the notice side.

Figure: comparison of Three outcomes under the CCPA sale test: Sale (emphasized: A transfer for money fits first, Money or value), Control exception (Buyer runs business), Deidentified (Three conditions). A transfer for money or other valuable consideration fits the definition of sale first, and the two exits need extra facts.

Talk to a privacy or commercial lawyer in your state before you sign.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [section 1798.140(ad)(1)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)
- [California Attorney General](https://oag.ca.gov/privacy/ccpa)
- [Attorney General announced](https://oag.ca.gov/news/press-releases/when-it-comes-data-privacy-consumers-must-be-driver%E2%80%99s-seat-attorney-general)