To sell or to “disclose for a business purpose.” That is the CCPA question.

“When asked, most companies state honestly they do not ‘sell’ customer data, but the CCPA defines the term in a surprisingly broad way that sweeps in any arrangement involving an exchange of value (‘consideration’) between the business and a third party or another business for the personal information. The definition of sale may expansively apply to disclosures to vendors that process data for their own analytics or other secondary purposes.”

In view of the broad definition of the term “sale” under CCPA, “businesses should, therefore, conduct due diligence on a case-by-case basis as to whether to seek shelter from the definition of ‘sale’ under the CCPA for disclosures to a ‘service provider.’ The due diligence should involve a review under the existing contractual terms and may require modifications to the underlying agreement and obligations of the parties.”

Details from The International Association of Privacy Professionals.