US CPRA Sharing and Cross-Context Behavioral Advertising

Cross-context behavioral advertising targets advertising to a consumer using personal information from that consumer's activity across other businesses or distinctly branded websites, applications, or services. A common example is sending a browser, device, or audience identifier to an advertising platform that combines it with activity from multiple businesses to select targeted ads.

Advertising based solely on personal information from the consumer's current interaction with the business is not cross-context behavioral advertising under this definition. The statute separately defines nonpersonalized advertising as advertising based solely on that current interaction, except for precise geolocation. Measurement data is sharing only when the business makes it available for cross-context behavioral advertising; labels such as analytics, measurement, first party, or advertising partner do not decide the classification.

A recipient that meets the statutory service-provider or contractor role is outside the definition of third party. The recipient must meet the role and contract requirements, and its processing must stay within permitted purposes. A contract label does not protect a flow if the recipient sells or shares the information, uses it outside the direct business relationship, or impermissibly combines it with information from other customers or its own consumer interactions.

The sharing definition also excludes a disclosure when the consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties. It also excludes use of an opt-out identifier solely to communicate the consumer's choice and a qualifying transfer in a merger, acquisition, bankruptcy, or similar transaction. Each is fact-specific. Hovering over, muting, pausing, or closing content does not count as an intentional interaction.

A business that shares personal information must disclose the practice and the consumer's right to opt out. It must provide the required notice and request method, honor qualifying opt-out preference signals such as Global Privacy Control (GPC), and stop the covered sale and sharing as soon as feasibly possible and no later than 15 business days after receiving the request.

If the business shares information after receiving the request but before it implements the opt-out, it must notify those third parties, direct them to comply with the request, and direct them to forward the request to any person to whom they made the information available during that interval. Except where the regulations allow otherwise, the business must wait at least 12 months before asking the consumer to consent to sale or sharing again.

Section 7150 also requires a risk assessment before a business begins selling or sharing personal information. A covered flow already underway before January 1, 2026, must be assessed by December 31, 2027. Review each assessment at least every three years and update it within 45 calendar days after a material change. The assessment is separate from the consumer opt-out and should cover the actual recipients, data, purpose, safeguards, benefits, and negative impacts of the processing.

A business with actual knowledge that a consumer is under 16 may not sell or share that consumer's personal information unless the required affirmative authorization is obtained: from the consumer when the consumer is at least 13 but under 16, or from the parent or guardian when the consumer is under 13. Willful disregard of age is treated as actual knowledge.

Also assess sensitive-personal-information limits separately. One processing activity can trigger more than one CCPA rule, but a sale-and-sharing opt-out does not automatically exercise every other right. Sector, data, entity, and activity exemptions in Civil Code section 1798.145 can change the analysis and should be applied to the specific information and conduct, not to an organization by label alone.

Privacy should approve the classification method and notices; marketing and advertising operations should inventory campaigns and recipients; engineering should control tags, SDKs, APIs, audience exports, and preference propagation; procurement should maintain contract restrictions; and a named owner should test the complete opt-out path.

For each flow, keep the data categories and identifiers, source and destination, recipient role, contract, advertising purpose, cross-context data sources, sale-and-sharing classification, exception analysis, consumer-facing notice, GPC and link behavior, downstream instructions, and dated test result. Reassess after changes to vendors, campaign features, identity matching, data clean rooms, conversion APIs, or recipient terms.