CCPA section 1798.140(t) provides that:
(t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
(t)(2) For purposes of this title, a business does not sell personal information when:
(t)(2)(A) A consumer uses or directs the business to intentionally disclose personal information or uses the business to intentionally interact with a third party, provided the third party does not also sell the personal information, unless that disclosure would be consistent with the provisions of this title. An intentional interaction occurs when the consumer intends to interact with the third party, via one or more deliberate interactions. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer’s intent to interact with a third party.
(t)(2)(B) The business uses or shares an identifier for a consumer who has opted out of the sale of the consumer’s personal information for the purposes of alerting third parties that the consumer has opted out of the sale of the consumer’s personal information.
(t)(2)(C) The business uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose if both of the following conditions are met:
(t)(2)(C)(i) The business has provided notice of that information being used or shared in its terms and conditions consistent with Section 1798.135.
(t)(2)(C)(ii) The service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose.
Also subsection 140(c) states:
(c) “Business” means:
(c)(1) A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners that collects consumers’ personal information or on the behalf of which that information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(c)(1)(A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
(c)(1)(B) Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.
(c)(1)(C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information.
Most of the CCPA will not apply to any entity that does not fit this definition of "business".
The implementing regulatiuons do not alter these definitions.
I do not think the fact pattern discussed in the question would constitute "selling" personal information (PI). However, there are a number of obligations imposed on a business that "sells or shares" personal information, and the above probaly does constitute "sharing", if tjhe firms qua;ifies as a "buisness" under 240(b).
Under section 1798.100(d) of the CCPA:
(d) A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that:
(d) (1) Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes.
(d) (2) Obligates the third party, service provider, or contractor to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title.
(d) (3) Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title.
(d) (4) Requires the third party, service provider, or contractor to notify the business if it makes a determination that it can no longer meet its obligations under this title.
(d) (5) Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.
Note that 1798.100(d) applies both to selling and to sharing for a business purpose.
Section 1798.115. (b) provides that:
(b) A business that sells or shares personal information about a consumer, or that discloses a consumer’s personal information for a business purpose, shall disclose, pursuant to paragraph (4) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) to the consumer upon receipt of a verifiable consumer request from the consumer.
Note that again this (and other provisions of 115) apply where selling or sharing occurs.
Section 1798.120 defines the right of the consumer to opt out of selling or, sharing. The opt out notice is required to be provided if the business "sells or shares" PI under 1798.120(b), "uses or discloses" sensitive PI for purposes other than those allowed by 1798.121(a). However the situation in the question seems to fall within the purposes allowed by 121(a).
These include:
- Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
- Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business. [as per 140(e)(8)]
The actual opt-out notice is described in 1798.135. It applies to a business that "sells or shares" PI. But no notice is required if the only sharing is for purposes allowed by 1798.121 (a).
Conclusion
If there is no selling of PI (as defined in 140(t)), and the only sharing is for purposes allowed by subsection 121(a) (which includes 140(e) paragraphs (4), (5), and (8)), or if the firm is not a "business" ad defined by 140(b), then there is no requirement to provide an opt-out notice as described by 135.
I think that this might well apply to the situation describes in the question, if no other selling or sharing occurs.
