CCPA Data Sharing: Sale, Share, or Neither?

Most form and landing-page data falls into one of 3 buckets: sale, sharing, or neither - and the label depends on who gets the data, what they can do with it, and what the contract says.

If I had to boil the whole article down, it would be this:

• If a third party gets personal information in exchange for money or some other thing of value, that is usually a sale.
• If a third party gets personal information for cross-context behavioral advertising, that is usually sharing.
• If a vendor only processes the data for me under a tight service provider or contractor agreement, the transfer is often neither.
• A tool can switch buckets based on its settings, scripts, and data-use terms.
• As of January 1, 2026, businesses that honor a Global Privacy Control (GPC) opt-out signal must show a clear confirmation, such as “Opt-Out Request Honored.”

That matters because lead-gen data is more than names and emails. Under the CCPA, it can also include IP addresses, cookie IDs, device IDs, referral URLs, and on-page behavior. So data may be collected before someone clicks Submit.

The short test I use is simple:

1. Who receives the data?
2. Is there any exchange of value?
3. Is the data used for ad targeting across sites or apps?
4. Can the vendor reuse, mix, or profile the data outside my account?

If the answer points to value exchange, think sale.
If it points to ad targeting across sites, think sharing.
If both are absent and the contract sharply limits use, think neither.

What is the CCPA Opt-Out Right?

Quick comparison

Bottom line: I should not classify a data flow based on the tool name alone. I need to check the contract, the page scripts, and the vendor’s actual data use.

When form and landing-page data is a CCPA sale

A CCPA "sale" doesn't mean money has to change hands. Under the law, a sale happens when personal information is disclosed to a third party for monetary or other valuable consideration. So the key issue is simple: does the recipient's contract, plus limits on how it can use the data, keep that transfer outside the sale rule?

"The CCPA's definition of 'sale' is surprisingly broad and sweeps in any arrangement involving an exchange of value ('consideration') between the business and a third party." - Brian Hengesbaugh, Partner, Baker McKenzie

Signs a transfer is likely a sale

A transfer is more likely to be a sale when the recipient is not a service provider or contractor under a written contract that tightly limits data use to the contracted service. That same risk shows up when the recipient can use your data for its own purposes, like improving models, building profiles across clients, or mixing it with other clients' data. Even free or low-cost tools can fall into this bucket when user data is the actual consideration.

You can see this in a standard marketing stack. A few common examples include:

• Ad platforms that receive hashed emails for lookalike audiences
• Enrichment services that use submitted data to update their own consumer databases
• Analytics tools that share data across clients for benchmarking

Lead-generation examples that can qualify as a sale

Both examples below show the same point: a sale can happen even when no direct cash payment is involved. Sephora's settlement involved undisclosed sales through third-party tracking scripts, with discounted advertising services treated as consideration. DoorDash's penalty involved exchanging customer names and addresses with other businesses for similar marketing data.

That same pattern appears in everyday marketing workflows, especially when form fills, pixel data, or hashed identifiers move to vendors that get to use the data beyond providing a narrow service.

Comparison table: Sale vs. non-sale form data transfers

When a transfer counts as a sale, opt-out duties apply right away. As of January 1, 2026, businesses must show a visual confirmation, such as "Opt-Out Request Honored", when they honor an automated opt-out signal like GPC.

sbb-itb-5f36581

When data sharing qualifies as sharing under CPRA

Under the CPRA, sharing has a very specific meaning. It applies when a third party gets personal information for cross-context behavioral advertising, even if no money changes hands. On landing pages, the usual trouble spots are pixels and audience tools.

What CCBA looks like on a landing page

On a landing page, the clearest examples are retargeting tools that follow visitors after they leave the page. CCBA means targeting people based on what they do across different websites, apps, or services. Retargeting pixels, audience-matching tools, and list uploads can all track visitors across sites and apps.

How sharing differs from sale and when both apply

Sale depends on consideration. Sharing depends on CCBA. So a transfer can count as sharing, but not a sale, when no consideration is exchanged. At the same time, many ad-tech transfers can meet both tests because the data is used for CCBA and the vendor gives something back in return.

"Many of the advertising disclosures that will be considered 'sharing' may also constitute 'sales', as the recipients of the information provide consideration (monetary or otherwise) for providing the advertising services." - James Denvil and Sophie Baum, Partners/Associates, Hogan Lovells

If a transfer counts as both, one opt-out request - or a Global Privacy Control (GPC) signal - has to stop that transfer for both purposes.

Comparison table: Sale vs. sharing vs. both

Use the table below to separate sharing from sale at a glance.

When a transfer is neither a sale nor sharing

If a transfer involves neither consideration nor cross-context behavioral advertising, it can sit outside both labels. In that case, the transfer may fall under a service provider or contractor relationship. But that only works if the contract says the right things and the vendor’s actual behavior stays inside those boundaries.

Service provider and contractor transfers that stay outside both labels

A transfer is neither a sale nor sharing only when the contract and the vendor’s real use of the data both fit service-provider or contractor limits. The contract must block sale, sharing, outside use, and commingling.

That last part matters more than people think. If a vendor combines your lead data with records from other clients to run its own analysis, the contract label stops protecting you.

"If the paper isn't right, the transfer becomes a sale or share. That reclassification cascades into opt-out obligations, notice obligations, and downstream liability." - Danny Riley, Author, Seyfarth Shaw LLP

Examples from form workflows, CRM syncs, and infrastructure tools

In a lead-gen stack, the clearest neither cases are tools that process data only for your account. That’s the basic idea behind many common form workflows.

A form builder that stores submissions only for your workflows can fit here. Reform fits this model when the contract limits use to your lead-generation workflows. A CRM sync also fits, but only if the vendor cannot use the data for cross-client analysis. The same logic applies to email automation and fraud-prevention tools: they stay in the neither bucket when the contract limits use to your account.

Analytics is a bit trickier. A basic analytics setup can qualify when the vendor processes data only for your account. But once ad-targeting or data-sharing settings are turned on, the transfer can shift into sharing.

Classification table: Common marketing tools by likely treatment

The tool category by itself doesn’t decide the label. The same type of tool can land in different buckets depending on the contract, the settings, and what the vendor does with the data behind the scenes. Use the four questions below to classify each tool and document the result.

A simple process to classify your data flows and document the result

Use this checklist to label each form and landing-page flow in a consistent way.

4 questions to ask for every connected tool

For each tool tied to your forms or landing pages, ask four plain questions. That usually gets you to the right label fast.

• Who gets the data? A service provider or contractor, or a third party?
• Is there a value exchange? In other words, does the vendor receive your lead data as part of a deal where the data itself is part of why the deal exists?
• Does the transfer support ad targeting across sites and apps? Even if no money changes hands, that counts as sharing.
• Can the vendor reuse or combine the data? If yes, treat it as third-party processing.

If Q2 is yes, classify it as a sale. If Q3 is yes, classify it as sharing. If both are yes, classify it as both. If both are no and the contract is tight, classify it as neither.

Then check that the contract and the settings line up with that label.

What to check in contracts, scripts, and form settings

Once you have a label, test the page, the contract, and the form settings against it. This is where a lot of teams get tripped up. The paperwork may say one thing, while the page does another.

Start by listing every tag and script. Open DevTools, go to the Network tab, and reload the page with GPC enabled. Then watch what fires. If third-party pixels like Meta, TikTok, or Google Ads load before any user interaction, that setup needs to be fixed.

On the contract side, look for direct language that blocks the vendor from selling or sharing your data, using it to improve its own models, or building outside profiles for other clients. Also check whether hidden fields or tracking IDs are being sent to ad platforms without an opt-out path.

Last, make sure every page that collects data shows the required opt-out link and returns the required confirmation message for automated opt-out signals.

Conclusion: The shortest way to think about sale, sharing, or neither

Sale turns on value. Sharing turns on ad targeting. Neither depends on a real service-provider or contractor relationship.

Classify based on the contract, the settings, and the way the data is actually used, not just the type of tool.

FAQs

How do I tell if a vendor is a third party or a service provider?

Check the vendor’s contract and pay close attention to how it uses your data.

A service provider handles data only for you and only for a specific business purpose. That arrangement needs to be set out in a written contract that blocks the vendor from using or disclosing the data for anything else.

If the vendor uses the data for its own purposes - such as improving its models, building profiles, or other commercial uses - it is a third party. In that case, the transfer counts as a sale or share.

Can one tool be a sale on one page and neither on another?

Yes. The same tool can count as a sale, a share, or neither. It all comes down to context and the agreement that governs the data transfer.

It’s a sale when personal information is exchanged for money or other valuable consideration.

It’s a share when personal information is disclosed for cross-context behavioral advertising.

And it’s neither when the tool works only as a service provider and the contract limits its use to that role.

What should I audit first to honor GPC on landing pages?

Start by simulating California traffic and checking whether the right privacy disclosures appear. Then inspect network requests to see whether third-party trackers fire before any banner interaction.

Also confirm your site reads the GPC signal through the Sec-GPC header or navigator.globalPrivacyControl and blocks those scripts right away. Finally, verify that Opt-Out Request Honored is clearly shown.

Related Blog Posts

• How GDPR and CCPA Impact Lead Generation
• Top 5 CCPA Form Compliance Mistakes
• GDPR vs. CCPA: Consent in Lead Scoring
• GDPR vs CCPA: Consent Rules for Global Leads