CCPA deidentified data: the three commitments a company must make

What does "deidentified" mean under the CCPA?

Under the California Consumer Privacy Act as amended by the CPRA, data is "deidentified" only if it cannot reasonably be used to infer information about, or be linked to, a particular consumer, and the business holding it meets three conditions. The conditions are reasonable measures, a public commitment and a contractual obligation on recipients. Missing any one means the data is still personal information.

The definitions sit in section 1798.140 of the California Civil Code, which is part of the official CCPA text. The statute is the primary source for everything below; regulations from the California Privacy Protection Agency add detail and were updated for 2026, so check current text before relying on any summary, including this one.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

The three commitments, one at a time

The wording below is a paraphrase of the statute. Read the statute itself for the exact language.

The test is cumulative. A dataset scrubbed of names but handed over with no contractual restriction does not meet the definition, however clean it looks.

Is deidentified data the same as aggregate consumer information?

No. The CCPA defines aggregate consumer information separately: information about a group or category of consumers from which individual identities have been removed and that is not linked or reasonably linkable to any consumer or household. Aggregate data is a statistical summary, such as monthly ticket volume by category.

Deidentified data is usually still record-level. A support ticket with names, account numbers and addresses removed is a deidentified record; a chart of tickets per week is aggregate. AI buyers generally want record-level material because the sequence of steps inside a record is the training signal, which is why the deidentified route matters more than the aggregate route for most licensing conversations.

How do other state laws compare?

Many comprehensive state privacy laws use a similar structure: data that cannot reasonably be linked to an individual, plus a public commitment and contractual flow-down. The details differ by state, including exemptions, definitions of "personal data" and what counts as a reasonable measure. Do not assume that satisfying California satisfies another state, or the reverse.

For a company with customers or employees in several states, the practical approach is to design to the strictest standard it handles and have counsel confirm the state-by-state position. HIPAA has its own, separate de-identification standard for health information, covered in de-identifying free text under HIPAA.

A useful habit is to write the three elements on one page for the owner and ask who in the company would own each: usually the privacy or legal lead for the commitment, IT or data engineering for the measures, and outside counsel for the contract clause. If no one can name an owner, the dataset is not ready for a licensing conversation yet.

Which elements map to a SourceX license?

SourceX works with the company before any work begins to agree de-identification and redaction requirements, and data moves only after an executed agreement and the company's authorization. The three statutory elements line up with controls a data license is built to address. The exact terms are agreed per deal.

Two points follow. First, the commitment is the company's, not SourceX's or a referral partner's, so it needs sign-off from the company's own counsel. Second, nothing is binding until the company agrees price and terms and signs.

When the deidentified route is not the right one

Deidentification is one path, not the only one. Some records are not personal information at all, such as internal SOPs and engineering documents. Others carry personal information but are licensed with notice, consent or other bases, which a lawyer should assess. Free text is the hard case: names hide in sentences, and a ticket thread can identify a person through context. See how to anonymize support tickets for a field-by-field approach.

Also check scope. The CCPA applies only to businesses that meet its thresholds and do business in California, as the California Attorney General's overview explains, and the thresholds explainer walks through them. A company outside the CCPA may still face other state laws, contracts and privacy-policy promises.

What a referral partner should do with this

Partners make introductions and give basic fit information only. You never handle, export or describe confidential records, and you do not advise on deidentification. Your job is to know when the topic will come up and to point the owner to the right people.

• Owners who say "our data is too sensitive" are often describing personal information, which can sometimes be handled. Use the too-sensitive objection answer as a starting point.
• Ask whether the company has a privacy counsel or a privacy officer before the first call.
• If the dataset is mainly consumer personal information with no licensing basis, it is a red flag. Say so and move on.
• For a broader view of what makes a dataset licensable, read what makes a company dataset licensable.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

Next step

Screen the company with the company fit checker, a preliminary, non-binding screen. If it looks like a fit, register as a partner and make the introduction. Owners can also apply directly at sourcex.si/apply.