Skip Repeated Content

What factors determine whether the use of an advertising cookie constitutes the sale of information?

June 30, 2020

Despite multiple requests, the California Attorney General has refused to clarify whether the use of an advertising cookie does, or does not, constitute the sale of personal information.  Instead, the Attorney General has taken the position that the question requires a “fact-specific determination” and has suggested that the following three factors may be relevant on a case-by-case basis:1

  1. Was “monetary or other valuable consideration involved?”2 Presumably, the Attorney General is concerned with any transfers of money or “valuable consideration” from adtech partners to website publishers in exchange for the ability to track visitors to the website. 
  2. Did “the consumer direct[] the business to intentionally disclose the personal information. . . .”3 The Attorney General has not provided guidance concerning what types of steps might evidence a consumer’s direction to intentionally disclose their information to an adtech partner, but this might include situations in which a website publisher displays a cookie notice or banner and asks a consumer to “opt-in” or “accept” the use of cookies. 
  3. Does the cookie provider qualify as a “service provider” under the Act.  While the Attorney General has not provided guidance concerning which types of advertising cookies might be consistent with a service provider designation, presumably, an adtech partner that has contractually agreed to limit its use, disclosure, and retention of information obtained through a cookie would be considered a “service provider.”

For more information and resources about the CCPA visit http://www.CCPA-info.com.


This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. FSOR, Appendix A at 13 (Response 47).

2. FSOR, Appendix A at 13 (Response 47).

3. FSOR, Appendix A at 13 (Response 47).

This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.