- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
If an App asks users to consent to the sharing of their information with AdTech partners, would that sharing be considered a “sale?”
Many Apps transmit information about their users to third party advertising technology companies to facilitate the placement of targeted advertising within the App which, in turn, generates advertising revenue for the App publisher.
Some privacy advocates, and plaintiffs’ attorneys, have argued that the CCPA’s broad definition of the term “sell” might encompass such activities. Specifically, they claim that the CCPA considers any “disclos[ure]” of personal information to be a “sale” when a company receives “monetary or other valuable consideration.” As the definition of “personal information” includes “unique identifiers” – a term which includes “mobile ad identifiers, or similar technology” – they have argued that the act of transmitting information about a user’s device to an AdTech partner should be considered a “sale” for the purposes of the Act.
While the definition of “sale” under the CCPA contains an exception for situations in which information is shared with a service provider, that exception may not apply to all AdTech partners.1 Specifically, to invoke the service provider exception the contract between an App publisher and an AdTech partner must “prohibit” the partner “from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract with the business.”2 Behavioral advertising networks that retain the information that they obtain from Apps and use that information for the benefit of themselves (or the benefit of other members of a behavioral advertising network) may not satisfy the definition of a “service provider.”
The definition of “sale” under the CCPA contains a second exception for situations in which a “consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party.”3 In order to mitigate the risk that sending user information to AdTech partners might be interpreted as a “sale” of information, some App publishers ask users to consent to the sharing of their information. If the App publisher obtains consent, it would have a strong argument that the consumer has “direct[ed] the business to intentionally disclose” their information and, therefore, the transfer of information is not a sale.