Is licensing company records a 'sale' under the CCPA?

Licensing data can be a sale under the CCPA when personal information of California residents goes to a third party for money or other valuable consideration. Properly de-identified records are analyzed differently. The definition is in Civil Code section 1798.140, and the company's counsel decides how it applies to a given scope.

Short answer: when does a license count as a sale?

It can be, if the records contain personal information and a business hands them to a third party for money or other valuable consideration. The CCPA defines "sell" broadly, so a license is not exempt just because it is called a license. Licensing properly de-identified records is analyzed differently from licensing personal information, and the company's counsel makes that call.

The definitions sit in Cal. Civ. Code section 1798.140, part of the official CCPA statute text. In summary, "sell" covers selling, renting, releasing, disclosing, making available or transferring a consumer's personal information to a third party for monetary or other valuable consideration. "Share" is a separate term that covers disclosure for cross-context behavioral advertising. Read the current section text for the exceptions and exact wording.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What matters in the definition

Three elements decide whether a transfer is a sale. Work through them in order.

Element	Question to ask	Why it matters for a licensing deal
Personal information	Do the delivered records identify, or reasonably relate to, a California resident?	If the delivered data is not personal information, the sale analysis may not start
Third party	Is the recipient a separate business rather than a service provider bound by a restrictive contract?	A buyer who uses records for its own purposes is generally a third party
Valuable consideration	Does the company receive payment or something of value?	A paid license usually meets this element

If all three are present, the sale rules can apply: notice that personal information is sold, a right to opt out, and extra limits for minors. A company that does not meet the CCPA's thresholds, or that holds no California residents' information, may be outside the statute entirely.

Why de-identification changes the analysis

The CCPA treats information that has been properly de-identified differently from personal information. The statute sets conditions for that status, which include technical measures and public commitments, and the exact test is in section 1798.140. Whether a given scope meets it is a question for counsel, not a label to apply casually.

For a SourceX scope, de-identification and redaction rules are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. The company, not the partner, decides what is in scope. The wider picture is in is it legal for a company to license its business records for AI training.

What to say when an owner asks about opt-outs

Owners usually fear that a license will trigger a mailing to every contact or a website banner. A measured answer helps.

Do not tell an owner the license is exempt, safe or compliant. Say what the statute asks and who decides.

Where sale questions come up most

CRM exports: contact names, titles and email addresses are personal information when they relate to California residents. See the CCPA B2B exemption guide for how business contacts are treated.
Employee records: workplace data is covered as well, as explained in the employee data exemption guide.
Call recordings and transcripts: card numbers raise a separate issue, covered in PCI DSS and call recordings.
EU data subjects: a different regime may apply, see whether the EU AI Act applies to a US company.

Questions for the company's counsel

Is the company a covered business, and which records relate to California residents?
Will the buyer receive personal information or de-identified records, and who documents the de-identification?
Do privacy notices say anything about sale, sharing or AI training?
Does the agreement bind the buyer to restrictions on re-identification and onward transfer?
Does the company need to update its notices before the license starts?

How this fits the referral process

You introduce the company; you do not assess its privacy position. The company completes a data inventory with SourceX, price and terms are agreed, and buyers review only after scoping. Candidates still need 50+ full-time employees at peak (contractors excluded), documented history, rights to license and an authorized sponsor. The CRM records checklist is useful when the main assets are sales records.

Next step

If a company you know holds years of operational records and its sponsor wants to understand the privacy questions first, register as a partner and use the company fit checker as a preliminary screen. See how it works for the stages after the introduction. No reward is guaranteed; it is payable only after the buyer pays and SourceX receives its fee.

Step 1Share your linkSend your personal link to a company you know.
Step 2Company appliesThe company applies itself at /apply.
Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
Step 4You get your rewardYour share of SourceX fees becomes payable.

Common questions

Does a license automatically count as selling personal information?

No. It counts only if the delivered records include personal information and a third party gives valuable consideration. A license of properly de-identified records is analyzed differently. The company's counsel makes the determination from the statute, so a partner should never tell an owner that a license is or is not a sale.

What is the difference between selling and sharing under the CCPA?

Sale involves disclosure for money or other valuable consideration. Sharing is a separate term about disclosure for cross-context behavioral advertising. A data licensing deal is normally analyzed under the sale definition, but counsel should read the current statutory text for both terms and their exceptions.

Do companies have to offer an opt-out before licensing records?

If the license involves selling personal information of California residents and the company is a covered business, opt-out and notice duties can apply. If the delivered records are properly de-identified, the analysis may differ. Counsel decides, and the answer shapes the scope SourceX and the company agree before work starts.

Is a company outside California affected?

It can be, if it is a covered business holding records about California residents. A company with no California residents' information and no California operations may be outside the statute, though other state laws or its own contracts may apply. Counsel should check which laws attach to each record set.

Does the partner need to understand the CCPA to refer a company?

No. A partner makes the introduction and gives basic fit information. Privacy review is handled by the company and its counsel inside the process. Knowing the basic question, whether delivered records are personal information, helps you answer an owner honestly without giving legal advice.

Free resources

Client opportunity brief generator — An editable intro email, summary and checklist.
Days sales outstanding calculator — How many days customers take to pay.
Business succession planning assessment — Ten questions on successor, transition and documentation.
All free tools · MCP resource center

By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09

Know a US company with valuable proprietary data?

Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.

Refer a company →

I own a business

Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.

Start an assessment