(t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising).
My experience is the "confusion" is in what constitutes "other valuable consideration:" Can a company offer a personal data marketplace using credits that can only be used to obtain other personal data, and can only be obtained by sharing personal data? (e.g. the old data.com connect model). The code suggests maybe, but I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.
> Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising).
Except the definition you quoted doesn't say anything about "using" the information to provide a product (ie targeted advertising), it only talks about actually transferring that information to "another business or third party for monetary or other valuable consideration". So if the information doesn't leave Google's servers then it seems like it doesn't apply to Google.
1. The ad tag Google delivers to publishers captures personal data like IP addresses and cookies, non-personal but potentially privacy-leaking data such as the URL the user is visiting, and somewhere in-between marketing segments that the user may belong to, and delivers that information (usually in JSON) to hundreds or even thousands of different advertisers using a protocol called OpenRTB.
2. The ad tag being served can also include an impression tracker. This is usually a pixel (literally an <img tag!) that refers to the advertisers' server where they record counts, sometimes media spend, and because it's a third-party server, that advertiser will receive (automatically) the IP addresses and cookies, the URL the user is visiting, and so on.
3. One of Google's products includes custom segments which contain IP addresses and cookies for one or more ad exchange. This is actually delivered in a flat file to buyers, and while Google themselves do not offer this service publicly (so conceivably the contracts could be updated to be CCPA-compliant), other exchanges that are like Google in other ways certainly do not.
It is entirely possible your point is accurate for someone who doesn't provide ad exchange services or impression trackers or custom segments (such as Facebook), but it is also likely that some party selling a product that is derived from the use of this data will be considered in-scope. I would steer clear of companies that favor an alternate interpretation until the Attorney General has had a say.
>I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.
He was one of two AGs to not join other state AGs in their antitrust investigation of Facebook [1], so I'm not holding my breath. Private right of action is what's going to hold businesses accountable, even though it's also been crippled [2].
https://leginfo.legislature.ca.gov/faces/codes_displaySectio....
(t) (1) “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
https://leginfo.legislature.ca.gov/faces/codes_displaySectio....
Even if Google doesn't pay you for your data, you still have the right (as a resident of California) to prevent Google from selling on your data directly, or in using your data as part of a sale (e.g. targeted advertising).
My experience is the "confusion" is in what constitutes "other valuable consideration:" Can a company offer a personal data marketplace using credits that can only be used to obtain other personal data, and can only be obtained by sharing personal data? (e.g. the old data.com connect model). The code suggests maybe, but I suspect the Attorney General will take as broad a view as possible, so I'd steer clear from any startups that think this is a good idea.