California CPRA Sharing and Cross-Context Behavioral Advertising

Trace the information from collection to the advertising recipient and ask four questions: Is it personal information? Does the business communicate or make it available to another person? Is that person a third party for this service? Will the recipient target advertising using information obtained from the consumer's activity across other businesses or distinctly branded sites, apps, or services? If all four answers are yes, the flow is sharing even when the arrangement is unpaid.

The statute excludes three situations from sharing: the consumer directs an intentional disclosure or intentionally interacts with a third party; the business passes an opt-out or sensitive-information limitation identifier so others can honor the choice; or personal information transfers as an asset in a merger, acquisition, bankruptcy, or similar change-of-control transaction and remains subject to the statutory conditions. These are narrow exclusions. A consumer's ordinary use of a website is not enough by itself to show that the consumer directed an ad-tech disclosure.

Contextual or nonpersonalized advertising based only on the consumer's current interaction can fall outside cross-context behavioral advertising. A service provider or contractor may provide advertising or marketing services, but cannot contract to provide cross-context behavioral advertising in that role. A person providing cross-context behavioral advertising is a third party for that service. The label in the contract does not override the recipient's actual use of the data.

A business that shares must tell consumers that their personal information may be sold or shared and that they have a right to opt out. Its privacy policy must describe the right and the available method. Unless the business qualifies for the frictionless preference-signal alternative in Civil Code section 1798.135(b) and section 7025 of the regulations, it must also provide the required "Do Not Sell or Share My Personal Information" link or compliant alternative link.

The business must offer at least two designated opt-out methods, chosen for how it interacts with consumers and collects the information. An online business must, at minimum, accept a qualifying opt-out preference signal and provide an interactive form through the required link, alternative link, or privacy policy when the frictionless alternative applies. It cannot require an account or identity verification and may request only information needed to carry out the opt-out.

A qualifying opt-out preference signal applies to the browser or device and associated consumer profiles, including pseudonymous profiles. If the business knows the consumer, it must also apply the signal to that consumer. An anonymous browser signal does not require the business to connect data it cannot reasonably associate with that browser. Posting an opt-out link does not excuse the business from processing qualifying signals.

Stop sharing as soon as feasibly possible and no later than 15 business days after receiving the request. Notify third parties that received the consumer's information after the request but before compliance, direct them to honor the request, and require them to pass it to anyone to whom they made the information available during that period. The business must provide a way for the consumer to confirm that the opt-out was processed and generally must wait at least 12 months before asking the consumer to consent again.

A business that shares with a third party must have an agreement identifying the limited and specified purposes, limiting the third party to those purposes, requiring the same level of CCPA protection for the information, and giving the business rights to check, stop, and remediate unauthorized use. The agreement must also require notice if the third party can no longer comply. A service-provider or contractor agreement needs the separate terms in section 7051; using that label without the required contract and restricted use may leave the recipient outside that role.

Keep a dated inventory of advertising technologies and server-side transfers; data-flow and recipient-role maps; the sale and sharing analysis; contracts and due diligence; privacy-policy and choice-interface captures; preference-signal test results; consent and under-16 authorization records where applicable; suppression and downstream-notification logs; confirmation-state tests; and retests after material product, vendor, or purpose changes.

Test actual behavior before and after an opt-out. Common failures include sending identifiers before the choice takes effect, failing to cover server-side transfers or a known consumer's linked profile, treating an unpaid disclosure as outside sharing, or relying on contract wording while the recipient combines data for cross-context advertising.