California's 2020 privacy law redefined what counts as a sale

The revenue mechanism

California's Consumer Privacy Act was signed in 2018 but, under its own text, became operative on 1 January 2020; the statute states the relevant title was effective January 1, 2019, with substantive provisions operative January 1, 2020. The law matters to publisher revenue because programmatic advertising typically transfers browsing data to ad exchanges and demand-side platforms in exchange for the ability to sell ad space at a market rate. The statute defines sell to include disclosing a consumer's personal information to a third party for monetary or other valuable consideration, broad enough to capture most real-time-bidding data flows even where no direct cash payment changes hands.

What the documents show

The statute gives California residents the right to know what personal information is collected, the right to delete it, and the right to opt out of its sale, and the California Attorney General's own CCPA guidance states that in November 2020 voters approved Proposition 24, the California Privacy Rights Act, amending the CCPA with protections beginning January 1, 2023, including a right to correct inaccurate information and to limit use of sensitive personal information. The Attorney General's page treats CPRA as amending rather than replacing CCPA, calling the combined law CCPA, as amended. The statute separately defines cross-context behavioral advertising as excluded from an otherwise available service-provider exception, the specific hook bringing most third-party ad targeting within the opt-out right.

The assumptions exposed

The Attorney General's page is official guidance, but the operative legal text is the statute itself; where the two diverge on a technical point, the statute controls, and detailed compliance questions typically require the implementing regulations, which the page states took effect March 29, 2023. The sale definition does not require money to change hands, only valuable consideration, so a publisher assuming only paid data deals count as a sale reads it too narrowly. The opt-out right applies specifically to California residents, not a publisher's entire audience, so a compliant mechanism must actually identify that population.

What to check before you rely on it

This is an editorial checklist, not legal advice: confirm whether the site's ad-tech data flows meet the statute's sale or sharing definitions, since either can trigger an opt-out obligation; confirm the site honors the Global Privacy Control signal as a valid opt-out method, which the Attorney General's page states is required; and confirm service-provider contracts with ad partners restrict use of shared data to purposes CCPA permits.

• Does the site's opt-out link cover both the sale and sharing of personal information, as the CPRA amendments require?
• Is there a documented process for honoring a Global Privacy Control signal automatically, without requiring an account?
• Are contracts with ad-tech partners updated to reflect the CPRA-era definitions rather than the original 2018 text?

The date most publishers should anchor to operationally is 1 January 2020, when the original obligations became enforceable, with 1 January 2023 marking the CPRA amendments layered on top.