CCPA risk assessments before selling or sharing personal information

When does the CCPA require a risk assessment?#

The CCPA requires a risk assessment when a covered business plans processing that the regulations treat as a significant risk to consumers' privacy, and selling or sharing personal information is on that list. The regulations were adopted by the California Privacy Protection Agency, the state's dedicated privacy regulator.

Other listed activities may include processing sensitive personal information and certain uses of automated decision-making technology. A licensing project can touch more than one: support transcripts may contain sensitive details, and a buyer's intended use can raise questions of its own. Map each activity separately rather than assuming one assessment answers everything.

Two threshold questions come first. Is the company a business covered by the CCPA, which depends on doing business in California and meeting one of its thresholds? Secondary guides report the annual gross revenue threshold was adjusted to $26,625,000 effective January 2025, alongside alternatives based on buying, selling or sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing it; a mid-size company may clear the revenue test without ever thinking of itself as a data business. And from when do the assessment obligations apply to your processing, given the phased dates in the regulations? Counsel should confirm both against the current text.

Selling, sharing or neither: how a data license may be classified#

How a data license may be classified depends on what the recipient receives and what the company gets in return. Under the CCPA, selling broadly means disclosing personal information to a third party for money or other valuable consideration, while sharing means disclosing it for cross-context behavioral advertising.

An AI developer licensing records for its own model work usually acts as a third party rather than your service provider, because the use serves its purposes, not yours. Counsel should confirm the classification for the specific contract.

What the assessment should document#

The assessment should document why the company wants to process the information, what is involved, what could go wrong for the people in the records, which safeguards apply and whether the benefits justify the remaining risk. The regulations prescribe specific content, so build the template from the current text with counsel; the list reflects what such assessments generally capture.

Write the purpose and the safeguards as if a regulator will read them, because one may. A phrase like industry-standard protections invites questions; a named removal process and a named contract clause answer them.

• 1Purpose: the specific reason for the sale, stated plainly rather than as general business improvement.
• 2Categories of personal information, with sensitive personal information called out separately.
• 3Operational details: source systems, date range, how records are selected, who receives them and how long they keep them.
• 4Benefits to the business, to consumers and to others, stated concretely.
• 5Negative impacts, such as re-identification, exposure of sensitive details, loss of control over use and discrimination.
• 6Safeguards: identifier removal, contract terms, access controls, deletion duties and audit rights.
• 7The decision: proceed, proceed with changes or stop, with the names of the people who reviewed and approved it.

How de-identification changes the analysis#

De-identification changes the analysis because information that meets the CCPA definition of deidentified is not personal information, so licensing it is generally not a sale of personal information. The definition carries conditions, commonly summarized as reasonable technical measures against re-identification, a public commitment not to re-identify, and contract terms requiring recipients to do the same.

The everyday meaning of anonymized is not the legal test. Operational records hide identifiers in free text: a homeowner's street in a technician's note, a phone number in a chat transcript, a name in an email signature quoted inside a ticket. Pseudonymized records, where the company keeps a key that reverses the tokens, generally remain personal information.

Many companies document an assessment-style review of the de-identification itself, even when counsel concludes no formal assessment is required. It records why the package is not personal information, which is the first question a regulator or buyer will ask.

When to run the assessment in a licensing project#

The assessment should run before any personal information leaves the company, and ideally before a term sheet, while its findings can still change the scope. An assessment written after delivery only documents a decision already made.

Tie each stage to a named owner. The privacy lead drafts, the system owner supplies the operational facts, and someone with authority to bind the company approves.

• 1At the fit check, record which systems hold personal information and about whom: customers, end users, employees or business contacts.
• 2Before a term sheet, decide with counsel whether the package will be personal information or deidentified.
• 3During rights review, check privacy notices and customer contracts for promises about selling or sharing.
• 4During preparation, document the removal method and the test results.
• 5Before release, complete and approve the assessment and file it with the license and the release authorization.

Illustrative: a property software company narrows its dataset#

Illustrative: a fictional vertical software company serving property managers wants to license years of support conversations from its help desk. Many conversations come from end users in California and include names, emails, unit addresses and occasional payment disputes.

Its privacy lead runs the assessment early. The first draft shows a likely sale, sensitive details in some threads and a privacy notice stating that the company does not sell personal information. Rather than license raw records, the company chooses a deidentified package: identifiers removed from structured fields and free text, payment threads excluded, a buyer contract barring re-identification and onward disclosure, and the public commitment the definition calls for.

The assessment records the reasoning, the removal method, the test results and approval by the chief executive and general counsel. The company proceeds with a smaller, cleaner package and a file it can show a regulator, an auditor or a future acquirer.

How SourceX handles privacy in a license#

SourceX handles privacy as its own step rather than a final scrub. In the SourceX five-step transaction, Preparation removes personal and confidential details before any release, and the supplier approves the result in the Approval step before Delivery.

The SourceX Evidence Packet includes the privacy record, which documents what was removed and how, alongside provenance, licensing rights, permitted use and release authorization. Whether a formal CCPA risk assessment is required is the supplier's decision with its own counsel; the privacy record gives that assessment concrete facts to cite. Nothing is shared during the initial assessment.