Under the California Consumer Privacy Act, licensing personal information to an AI company for money counts as a sale, which brings notice and opt-out duties. Data that meets the CCPA's definition of deidentified is not personal information, so licensing it is not a sale of personal information.
The second route is the one most data deals aim for, and it has three conditions that are easy to miss. This page is general information, not legal advice, so confirm your position with a privacy lawyer.
What counts as a sale
The CCPA defines "sell" in Civil Code section 1798.140 broadly: selling, renting, releasing, disclosing, making available or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration.
A data license for AI training fits that definition if the data still contains personal information. Money changes hands, the buyer is a third party, and the data is made available to it. Calling the deal a license instead of a sale doesn't change the analysis.
A sale brings duties to tell people about it and honor requests to opt out. For records you already hold, that can mean filtering out everyone who opted out, and updating your privacy notice before the deal.
Business contacts count
People inside your CRM or support system are consumers under the CCPA if they are California residents, even when they act for their employer. The statute's definition of personal information lists professional and employment-related information among its examples, so names, work emails and job titles of client staff can all be personal information.
That matters for CRM exports, support tickets and invoices, which are full of named people at other companies. Our CRM guide covers how to handle them.
The three-part deidentified test
Section 1798.140 also defines deidentified information. It is information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided that the business holding it:
- Takes reasonable measures to ensure the information cannot be associated with a consumer or household.
- Publicly commits to maintain and use the information in deidentified form and not to attempt to re-identify it.
- Contractually obligates every recipient to comply with the first two requirements.
All three have to be true. Data that has been scrubbed well but goes to a buyer with no contract ban on re-identification fails the third condition. Data with a perfect contract but obvious quasi-identifiers left in fails the first.
Reasonable measures
The statute doesn't list techniques. In practice, reasonable measures look like the work described in de-identification vs anonymization: remove direct identifiers, generalize rare values, drop or review free text, and test whether records can be singled out. Removing names alone is weak, because combinations of ordinary fields identify most people. Latanya Sweeney found 87% of Americans were likely unique on ZIP code, gender and date of birth.
The public commitment
This is a statement, usually in your privacy notice or a dedicated page, that you keep the data deidentified and won't try to re-identify it. It costs little and is often forgotten.
The contract
Every license should ban re-identification. Ours do, along with resale, combining with other data, and onward sharing without the same terms.
Are you a data broker?
California's Delete Act requires data brokers to register with the California Privacy Protection Agency. The definition covers a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship.
Two parts of that definition help most sellers. Licensing deidentified data isn't a sale of personal information. And many of the people in your records are your own customers, who have a direct relationship with you. Records about people you never dealt with, such as staff at your clients' suppliers, are where the question gets harder.
If you do fall inside the definition, the CPPA says you must register by January 31 for any year you operated as a data broker, and the penalty for missing the deadline is $200 per day. The CPPA's data broker page has the details. Ask your lawyer to check the definition against your actual data flows.
Sector rules sit on top
The CCPA leaves room for other laws. Health information, financial data covered by federal privacy rules, and tax return information each have their own regimes, and some are stricter. Accountants should read selling accounting data for the federal tax-preparer rules. We give health, finance and government data its own review or leave it out.
How we handle California data
Our process covers two of the three conditions, and the third is a statement only you can publish:
| Condition | What we do |
|---|---|
| Reasonable measures | Our SDK scrubs data on your machine, removes direct identifiers, swaps people and clients for pseudonyms, generalizes amounts, dates and titles, and drops unreviewed free text. We test for re-identification before every sale and keep the report. |
| Public commitment | Yours to publish: add the statement to your privacy notice before the first license. |
| Contract | Every buyer license bans re-identification, resale and combining, and binds anyone the buyer shares with. |
You also approve every buyer by name before a license is signed.
Check the value before the paperwork
Our calculator estimates what your records could earn, and recurring data revenue shows how a license with a refresh term pays each month. When you're ready, start at sell data to AI companies.
Frequently asked questions
Is licensing data to an AI company a sale under the CCPA?
If the data includes personal information, yes. The CCPA counts making personal information available to a third party for money or other valuable consideration as a sale, whatever the contract calls it.
Is deidentified data covered by the CCPA?
Data that meets the statutory definition is not personal information. The business must take reasonable measures against re-identification, publicly commit not to re-identify, and contractually bind every recipient to the same.
Do I need to register as a data broker to sell deidentified data?
Usually not, because the Delete Act definition concerns selling personal information about consumers you have no direct relationship with. Check your data flows with a lawyer, since the penalty for failing to register is $200 per day.
Are business contacts in my CRM covered?
Yes, if they are California residents. The CCPA's definition of personal information includes professional and employment-related information, so work contacts are covered like anyone else.