January 1, 2020 brings important new privacy rights for California residents as the California Consumer Privacy Act (“CCPA”) goes into effect. Following in the footsteps of the European Union’s General Data Protection Regulation (“GDPR”), the California legislature enacted the CCPA which enhances privacy rights and consumer protection by providing California consumers more control over the collection, processing, sale, and disclosure of their personal information.
While California leads the nation in privacy protection, the CCPA has posed significant challenges to organizations subject to the new law due to its sometimes ambiguous language and broad provisions. The Act was purposefully written with broad language, giving the express authority to the California Attorney General to enact regulations and clarify specific provisions of the Act. One of the areas the Attorney General did not address in its Draft Regulations is the question of what is considered a “sale” under the CCPA?
Per the Act, “sale” is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” Section 1798.140(t)(1) (emphasis added). However, the Act does not define what “other valuable consideration” means, which has caused challenges for businesses to determine whether they are considered a seller under the Act.
Until further guidance is provided by the Attorney General or the legislature, we must look to the courts in order to understand how “sale” may be defined in the context of “valuable consideration.” Since the CCPA has not seen any enforcement action, there is no case law on point. However, we can still look to California courts, which have given meaning to “valuable consideration” in other contexts.
One source we can look to is California contract law. The basis of any contract is consideration, which “must be an act or a return promise, bargained for and given in exchange for the promise.” Simmons v. Cal. Inst. of Tech., 34 Cal. 2d 264, 272 (1949). Under this test, the key question is whether the exchange motivated the other party’s promise or performance. Furthermore, both parties must understand and have intended for the bargained for exchange. One common example of non-monetary consideration are nondisclosure agreements where one party agrees to allow another access to confidential information in exchange for service.
If valuable consideration under the CCPA is interpreted in a manner consistent with California contract law, any agreement between two parties where personal information is exchanged in order to motivate the other party’s promise or performance would be considered a sale under the CCPA. For example, when a company includes advertising cookies on their website and the advertiser is able to use the personal information to help improve retargeting or cross targeting to the consumer. In such a case, the company receives a benefit that would likely be considered a sale under the CCPA.
However, this may be too broad an interpretation. California courts have narrowed the scope of valuable consideration by holding, even where an exchange induces another party’s promise or performance, this exchange will be considered too remote or ancillary, and is not consideration, where the exchange is not material to the bargain. See People v. Shira, 62 Cal. App. 3d 442. For example, if a company gets anonymous demographic information in return for including an advertiser’s cookies on its site, this may be considered too remote or ancillary under this line of reasoning.
Ultimately, the scope of the CCPA’s definition of “sale” will likely remain elusive until its meaning under the CCPA is tested.