Sharing personal information under the CCPA refers specifically to disclosing personal information for cross-context behavioral advertising. In 2026, updated regulatory guidance confirms that many common advertising tools qualify as sharing even when no money is exchanged. Sharing occurs when businesses transfer identifiers to third parties that use them to personalize ads across websites or apps. This includes retargeting, lookalike audience programs, and ad network integrations. Businesses that engage in sharing must provide opt-out options, honor opt-out signals, and update privacy disclosures. This guide explains how sharing works, identifies common scenarios, and clarifies how it differs from selling under the CCPA.
What Counts as Sharing Personal Information Under the CCPA
Introduction
Sharing is one of the most important concepts introduced by the CPRA and expanded through 2026 regulatory updates. While selling focuses on value exchange, sharing focuses on advertising, specifically, cross-context behavioral advertising.
If your business runs targeted ads, uses advertising pixels, or works with any third-party ad network, sharing may be taking place. This guide explains the definition, examples, and obligations related to sharing under the CCPA.
The legal definition of sharing personal information
Sharing means disclosing personal information to a third party for cross-context behavioral advertising, regardless of monetary exchange.
Cross-context behavioral advertising includes:
- Serving ads based on user activity across websites or apps
- Using personal information to build behavioral profiles
- Targeting based on browsing history, interactions, or preferences
The definition applies even when the business does not directly pay for the advertising tool or network.
What counts as sharing personal information?
1. Retargeting ads
If a visitor views a product and later sees ads for it on other websites, sharing may have occurred.
2. Advertising pixels
Pixels that collect identifiers and send them to ad networks for targeting typically fall under sharing.
3. Lookalike audience programs
Platforms match customer attributes to find similar users, relying on disclosed data.
4. Cross-site or cross-app tracking
Tracking technologies that follow users across digital properties.
5. Third-party ad services
If data flows to an ad network for personalized advertising, the transfer likely counts as sharing.
Examples of sharing personal information
Advertising networks
Ad networks receiving cookie IDs, IP addresses, or device identifiers for personalized ads.
Social media advertising tools
Platforms that use visitor data to personalize ads across accounts.
Video ad monetization
If a site displays ads based on viewer behavior across platforms.
Email-to-ad conversions
Providing email hashes to platforms to target advertising.
What does NOT count as sharing of personal information?
Not every advertising-related data transfer qualifies as sharing.
Contextual advertising
Showing ads based on the content of a page, without behavioral data, does not count.
Service provider relationships with strict limitations
If a vendor uses data solely to provide contracted services and cannot repurpose it, the transfer may not be sharing.
Consumer-directed disclosures
If a user intentionally directs the disclosure, it is not considered sharing.
Sharing personal information vs. selling personal information
Selling of personal information | Sharing of personal information |
|---|---|
Triggered by value exchange | Triggered by cross-context behavioral advertising |
Monetary exchange not required | Monetary exchange not required |
Includes wide range of data uses | Limited to behavioral advertising |
Requires opt-out | Requires opt-out |
Can overlap with sharing | Always distinct |
Many businesses engage in both activities, especially if analytics and advertising tools are used simultaneously.
Business obligations if sharing occurs
If your business shares personal information then you must do the following:
1. Provide a “Do Not Sell or Share My Personal Information” link
This must be prominently displayed on your website, in the footer.
2. Honor GPC
Opt-out preference signals apply to sharing. You must honor GPC signals.
3. Update privacy policies
Your privacy policy must disclose:
- Whether you share personal information
- Categories of personal information shared
- Categories of third parties
- Consumer rights
4. Review ad network contracts
Ensure any third parties you share personal information with are properly classified.
Common misunderstandings about sharing personal information
“Sharing only applies if money changes hands.”
No, sharing is based on advertising purposes.
“Analytics is sharing.”
Not necessarily. Analytics may be selling, but not sharing, unless used for targeted advertising.
“Retargeting is harmless.”
Retargeting is one of the clearest forms of sharing.
“Only large companies share data.”
Small businesses that run digital ads also engage in sharing.
How to identify sharing in your marketing stack
Review the following:
1. Advertising tools
Facebook Pixel, Google Ads, TikTok Pixel, LinkedIn Insights, and similar tools often involve sharing.
2. Data flows between platforms
If identifiers move between tools that serve ads, sharing may occur.
3. Lookalike or audience expansion features
These require sharing personal information.
4. Pixels, tags, SDKs, and scripts
If they collect identifiers and send them to ad networks, sharing is likely.
FAQs about sharing personal information under the CCPA
Sharing refers to disclosing personal information to a third party for cross-context behavioral advertising. This includes any activity where a user’s behavior on one site or app is used to personalize ads on another platform. Sharing does not require monetary exchange and often occurs through advertising pixels, SDKs, or data matching systems.
Selling is triggered by value exchange. Sharing is triggered by advertising purposes. If the transfer supports personalized ads across contexts, such as retargeting or audience building, it counts as sharing, even if the business receives no direct value.
Cross-context behavioral advertising occurs when:
- Ads are customized based on browsing behavior
- A user is tracked across different websites or apps
- Platforms analyze activity to optimize ad delivery
- Advertising partners use identifiers to build audience segments
This type of personalization directly triggers sharing obligations.
Common examples include:
- Meta Pixel
- Google Ads remarketing tags
- TikTok Pixel
- LinkedIn Insight Tag
- Customer Match uploads
- Lookalike audience creation
- Programmatic ad exchanges
If these tools track user behavior across contexts, sharing is likely.
No. Unlike selling, sharing is defined entirely by the advertising purpose. Even if the business does not gain a direct benefit, sharing occurs when personal information is used for behavioral advertising across unrelated contexts.
Google Analytics itself is not always sharing. However, sharing can occur when GA4 is:
- Linked to Google Ads
- Used with Google Signals
- Configured with data-sharing settings
- Used for Audience Builder or remarketing workflows
In these cases, identifiers may flow into advertising systems, triggering sharing.
Yes. Hashed identifiers used for customer match or lookalike audiences count as personal information and may qualify as sharing if used for cross-context advertising.
Often, yes. Tools such as Meta Custom Audiences or TikTok Custom Audiences rely on user behavior across platforms. When your business uploads or transmits identifiers to them for ad targeting, sharing may occur.
Yes. Retargeting is one of the most common examples of sharing because it uses user behavior on one site to influence ads served elsewhere.
Businesses engaging in sharing must:
- Display a “Do Not Sell or Share My Personal Information” link
- Respond automatically to Global Privacy Control (GPC) signals
- Update privacy notices
- Provide a preference interface that allows opt-outs
- Confirm opt-out status visibly starting in 2026
- Complete a documented risk assessment before engaging in sharing
When a consumer opts out:
- Advertising pixels must stop collecting personal information
- Identifiers must not be transmitted to ad platforms
- Behavioral targeting based on the consumer’s activity must stop
- A confirmation must be displayed (e.g., “Opt-Out Request Honored”)
Yes, but only if strict contract terms are in place. A vendor must be prevented from:
- Reusing data
- Building advertising profiles
- Utilizing identifiers in its broader ecosystem
Most advertising networks cannot meet these restrictions, so they are usually treated as third parties.
No. Contextual advertising uses page content rather than user behavior across sites. It does not involve tracking identifiers between unrelated contexts, so it does not qualify as sharing.
Yes. Sharing rules apply to any behavior-based advertising across digital contexts, including apps, websites, streaming platforms, connected TVs, and mobile devices.
Businesses can:
- Disable behavioral advertising features
- Restrict vendor data use
- Replace ad pixels with contextual tools
- Use service provider agreements where possible
- Implement a consent platform to manage opt-outs and GPC responses
Alex is a Content Developer at Clym, where he researches and writes about everything related to data privacy and web accessibility compliance for businesses, helping them stay informed on their compliance needs and spreading awareness about making the web safer and more inclusive. When he’s not writing about compliance, Alex has his nose in a book or is hiking in the great outdoors.
Find out more about Alex