Skip to main content

When website ad tracking triggers a risk assessment

Selling or sharing personal information is the first item on the CCPA's list of processing that needs a risk assessment. For many companies, that sharing happens through the advertising tags on their own website.

Last reviewed November 2026. Based on the CPPA regulations in effect January 1, 2026 (Cal. Code Regs. tit. 11, §§ 7150–7157).

The short version

  • Sharing means making personal information available to a third party for cross-context behavioral advertising, with or without payment.
  • Ad pixels and retargeting tags that send visitor data to ad platforms for targeting can count as sharing.
  • Sharing triggers a risk assessment under § 7150(b)(1), even when you honor opt-outs.
  • Your report has to describe the real data flows: what is collected, which third parties receive it, and what consumers are told.

What "sharing" means under the CCPA

The CPRA amendments added sharing as its own concept. Civil Code § 1798.140(ah) defines it as sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to a third party for cross-context behavioral advertising, whether or not for money or other valuable consideration.

Cross-context behavioral advertising, under § 1798.140(k), is targeting ads to a consumer based on personal information obtained from their activity across businesses, distinctly branded websites, apps, or services, other than the one they intentionally interact with.

The statute carves out two situations that are not sharing:

  • The consumer uses or directs the business to intentionally disclose information to, or interact with, a third party.
  • The business shares an identifier only to alert others that the consumer has opted out of sharing or limited use of sensitive data.

Where website pixels come in

Advertising pixels, retargeting tags, and similar scripts load from a third party and send data about the visitor and the page back to that third party. When that data is used to target ads to the visitor elsewhere, the flow fits the definition of sharing.

The regulations close one common workaround. Under § 7050(b), a service provider or contractor cannot contract with a business to provide cross-context behavioral advertising. A company that provides it is a third party for that service.

Whether a specific tag on your site is sharing depends on what it sends, to whom, and how the recipient uses it. That is a legal analysis for your counsel, and it starts with an accurate picture of what the tag actually does.

Why sharing triggers Article 10

Section 7150(b)(1) lists selling or sharing personal information as processing that presents significant risk to consumers' privacy. The regulations' own example, Business C in § 7150(c)(3), is a budgeting app that plans to show payday-loan ads on other websites based on users' financial information. It must conduct a risk assessment because it plans to share personal information.

Honoring opt-out requests and Global Privacy Control signals is required separately (§ 7025). It does not remove the trigger. It is one of the safeguards your assessment documents.

If your sharing started before 2026 and continues, the assessment is due by December 31, 2027. New sharing needs an assessment before it begins. See the full requirements.

What your assessment should document

For sharing through website tags, these § 7152 elements depend on how the site behaves:

  • Method of collection (§ 7152(a)(3)(A)). Which scripts collect data, on which pages, and what they send.
  • Disclosures (§ 7152(a)(3)(E)). What the banner, notice at collection, and opt-out link say, and when the visitor sees them.
  • Recipients (§ 7152(a)(3)(F)). The names or categories of third parties that receive data, and why.
  • Negative impacts (§ 7152(a)(5)). For example, impaired control if tags keep sending data after a visitor rejects tracking.
  • Safeguards (§ 7152(a)(6)). Consent gating, opt-out handling, and GPC support, and how you know they work.

The report template has every field.

Collecting the evidence

A tag manager shows what you configured. A browser shows what happens. Papaya's AI agents visit your site the way a person would, click reject-all or accept-all, send a Global Privacy Control signal, and continue through journeys like checkout. Each run records the cookies set, the network requests sent, the domains that received them, screenshots, and every agent step.

You end up with evidence for the operational, impact, and safeguard sections of the report, and a test you can run again after the next tag change. Papaya does not make the legal call on whether a flow is sharing. Your counsel does, with better facts.

Questions, answered.

Civil Code § 1798.140(k) defines it as targeting advertising to a consumer based on personal information obtained from their activity across businesses, distinctly branded websites, apps, or services, other than the one they intentionally interact with.

Sources

This guide summarizes the regulations for planning purposes. It is not legal advice. Papaya provides technical evidence; your counsel makes the legal calls.

More on Article 10

How Papaya helps

See what your tags really share.

Tell us which site to look at. We'll walk you through a live reject-all, accept-all, and GPC run and the evidence it produces for your sharing assessment.

  • A live run of reject-all, accept-all, and GPC journeys on your site
  • How each piece of evidence maps to the fields in § 7152
  • Which of your vendors receive data in each consent state
Which processing do you need to assess?

We use your details only to reply about your request.