Does the CCPA apply when you sell business data?

The CCPA, as amended by the CPRA, can apply when you sell or license business data, but only if your business meets its coverage thresholds and the data includes personal information about California residents. Business-to-business and employee data are not automatically exempt. Properly de-identified or aggregated data can fall outside many of its obligations.

This is general information and not legal advice. The statute and its regulations are detailed and have been amended and interpreted over time, so check the current text and speak to a qualified lawyer before you decide that the CCPA does or does not apply to you.

What is the CCPA, and what did the CPRA change?

The California Consumer Privacy Act is a state privacy law giving California residents rights over their personal information, and the California Privacy Rights Act amended and expanded it. Together they are often just called the CCPA.

The law regulates businesses that collect and use personal information about California residents, and it creates rights such as knowing what is collected, deleting it, correcting it and opting out of the sale or sharing of it. The CPRA added concepts including "sharing" for cross-context behavioural advertising, a category of sensitive personal information and a dedicated enforcement agency. The details of both the thresholds and the definitions have changed since the original law, so use the current version.

California is one of several US states with comprehensive privacy statutes, and they differ from each other. A national seller cannot assume that satisfying one state's rules satisfies another's.

Does the CCPA apply to my company?

It applies to a for-profit business that does business in California, collects personal information and meets at least one threshold. The thresholds relate to size, volume of personal information handled, or dependence on selling or sharing personal information.

In general terms, the tests are based on annual revenue above a stated amount, buying, selling or sharing the personal information of a large number of consumers or households, or earning a significant share of revenue from selling or sharing personal information. The dollar amounts are adjusted over time, so look up the current figures instead of relying on memory. Some entities that control or are controlled by a covered business, and certain joint ventures, can also be caught.

If you are below every threshold, the CCPA may not apply to you directly. That does not mean you are free of obligations: other state laws, contract terms, your own privacy notices and the buyer's requirements can still impose restrictions.

Is business or employee data exempt?

No, not automatically. The CCPA's definition of a consumer is any California resident, and the temporary exemptions for employee and business-contact data have expired, so that data can fall within the law.

This catches people out. A company may assume that records about business customers, such as names, work emails and job titles of people at client companies, are outside a consumer privacy law. The statute focuses on whether information relates to an identifiable California resident, not on whether the person acts as an individual consumer or as a business contact. Employee and applicant data can likewise be covered.

If your dataset is built from business interactions, such as support tickets, sales records or project communications, it likely contains personal information about individuals in those businesses. That is a reason to look at the content, not just the commercial setting.

What counts as a sale under the CCPA?

A sale is broadly defined as disclosing personal information to a third party for monetary or other valuable consideration. A data licensing deal that includes personal information can therefore be a sale, even if you call it a license.

The label does not control. What matters is whether personal information is disclosed to a third party in exchange for value. A fee for access to a dataset that includes California residents' personal information is the type of arrangement the definition is designed to capture. There are exceptions, for example for certain service-provider relationships and for some corporate transactions, but they are specific and should not be assumed to fit a data license.

If your deal is a sale of personal information, a covered business generally has to give notice, offer a way to opt out, honour opt-out signals and respect other rights such as deletion. The sale cannot be treated as an internal matter that customers never see.

What if the data is de-identified or aggregated?

The CCPA treats properly de-identified information and aggregate consumer information differently from personal information. If your data meets those definitions, many of the obligations that attach to personal information do not apply to it.

The conditions are demanding. For de-identified information, they include that the data cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, and that the business takes steps such as public commitment not to re-identify and contractual obligations on recipients. Pseudonymised data is not automatically de-identified, so a token or a hashed email is not enough by itself.

In practice this means that the preparation work covered in how to de-identify company data before selling it, and the concepts in anonymization vs pseudonymization explained, have direct legal consequences. They also reflect the GDPR's concepts, not California's, so do not assume the tests are identical.

What changes in the contract if the CCPA applies?

If the CCPA applies and the deal involves personal information, the contract should reflect the statute's requirements for third parties. The details are technical, so have them drafted or reviewed by a lawyer.

Points a contract commonly addresses:

• The limited and specified purposes for which the buyer may use the personal information.
• A commitment that the buyer will comply with applicable privacy law and give the same level of protection.
• The seller's right to take reasonable steps to ensure the buyer uses the data consistently with its obligations.
• The buyer's duty to notify the seller if it can no longer meet its obligations.
• A prohibition on re-identifying de-identified data and a requirement to bind downstream recipients.
• How deletion and opt-out requests are passed on to the buyer.

These requirements sit alongside the commercial terms in a data license agreement. If you are drafting terms from scratch, treat the privacy provisions as a distinct workstream, because a commercially perfect deal can still be unlawful in how it handles personal information.

What about data broker rules?

Some states have registration or disclosure rules for data brokers, and whether you fall within them depends on how the law defines the term. California, in particular, has had a registry for businesses that collect and sell personal information about consumers with whom they do not have a direct relationship.

A company selling its own first-party data is not necessarily a data broker under those definitions, but the definitions differ by state and the facts matter. A business that sells only de-identified or non-personal data, such as environment or benchmark data, may be well outside such rules. Check, instead of assuming.

The comparison between selling directly, through a marketplace or through a broker is explored in data marketplace vs data broker vs direct deal, though the legal classification depends on your activities, not on the label.

A practical checklist for sellers

Use this sequence to decide where you stand.

1. Determine whether you are a covered business, by revenue, volume or dependence on selling or sharing personal information.
2. Establish whether the dataset contains personal information about California residents, including employees and business contacts.
3. If it does, decide whether the planned disclosure is a sale or sharing under the statute.
4. Consider whether you can remove or properly de-identify the personal information so that the data falls outside the obligations.
5. If you cannot, check whether your notices, opt-out mechanisms and contracts support the disclosure.
6. Put the required terms into the license and record how requests will be handled.
7. Document the analysis, and review it when your business or the law changes.

Many sellers will find the answer simplest when they sell data that contains no personal information in the first place. Environment and evaluation data, and carefully prepared structured data, can fit that description, but you must verify the actual content.

When is the safest answer not to sell?

If the data is full of identifiable people, your notices do not cover the sale, and you cannot de-identify it reliably, the safest answer is not to sell it. The legal and reputational downside can outweigh the revenue.

Penalties and private rights of action exist under the law in certain circumstances, and customers who learn their data was sold without notice may react badly whatever the legal outcome. Sellers should be honest with themselves about whether the dataset is worth that risk.

If you want to understand value before you commit effort to the legal work, the free data valuation helps you see whether the dataset is worth the investment. Doing that first can save legal fees on data that was never going to command a meaningful price.

It also helps to ask a simple internal question: would we be comfortable if our customers read the deal terms? If the honest answer is no, the problem is probably in the data or the notices, and more drafting will not fix it.

Frequently asked questions

Does the CCPA apply to B2B data?

It can. The law covers personal information about California residents, and the earlier exemptions for business-contact and employee data have expired. Names, work emails and job details of individuals at client companies may be personal information. Whether the law applies to you also depends on whether your business meets the thresholds.

Is licensing data a sale under the CCPA?

It can be. The statute defines sale broadly as disclosing personal information to a third party for monetary or other valuable consideration, so calling the deal a license does not settle the question. If personal information is involved, treat the arrangement as a potential sale and check your obligations.

Does de-identified data fall outside the CCPA?

Properly de-identified or aggregate data is treated differently from personal information, and many obligations do not attach to it. The conditions are specific, including technical and contractual commitments, so removing names alone is unlikely to be enough. Document your approach and have it reviewed.

Do I need to offer an opt-out if I sell data?

If you are a covered business and the disclosure is a sale or sharing of personal information, the law generally requires notice and a way for consumers to opt out. The details depend on your situation, so confirm the current requirements with a qualified lawyer.

Can a small company ignore the CCPA?

Not safely without checking. A small business may fall below every threshold, but the thresholds include data-handling volume and dependence on selling personal information, not just revenue. Even if it does not apply, other state laws, contracts and buyer requirements can impose similar duties.