What counts as cross context behavioral advertising under the CCPA?

What is cross context behavioral advertising under California law?

The term comes from section 1798.140(k) of the California Consumer Privacy Act (opens in a new tab), as published by the California Privacy Protection Agency (CPPA) in the version effective January 1, 2026. The definition turns on the source of the data, not on the ad format or the buying method. The ad is selected from what the person did somewhere else.

The sharing definition also lists cases that are not sharing, such as when a consumer intentionally directs the business to disclose information to a third party. Those exceptions are narrow and written out in section 1798.140(ah)(2). The hub's privacy overview places California beside the Canadian and Quebec rules.

What does the right to opt out of sharing cover?

Section 1798.120(a) gives a consumer the right "to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information." For consumers the business knows are under 16, the default flips: section 1798.120(c) bars selling or sharing unless the consumer, or a parent for children under 13, has affirmatively authorized it.

The regulations set the clock. Section 7026(f) of the CCPA regulations (opens in a new tab) requires a business to stop selling or sharing "as soon as feasibly possible, but no later than 15 business days," and to notify third parties that received the data after the request and before compliance, directing them to forward it onward. The statute adds, in section 1798.135(f), that a person told of an opt out may then use the data only for a business purpose the business specifies.

The same subsection says that service providers or contractors collecting personal information under the written contract the CCPA requires do not make a sale or sharing. Section 7050(b) closes the loop for advertising: "A service provider or contractor cannot contract with a business to provide cross-context behavioral advertising," and a company that does so "is a third party."

Does contextual advertising count as sharing under the CCPA?

The statute never uses the word contextual. The regulations do, in two places. Section 7050(b)(2) gives this example of permitted service provider work: an advertising company hired by a cookware seller "can serve Business T by providing contextual advertising services, such as placing advertisements for Business T's products on websites that post recipes and other cooking tips." Section 7027(m) uses a religious bookseller serving "contextual advertising" within its own store or website as an example of short term, transient use.

The example describes the placement, not every data flow around it. Section 7050(b)(1) adds a contrast: a service provider may run ads based on aggregated or demographic information, but "cannot use a list of customer email addresses" to identify users on its platform. A retargeting segment or a third party audience added to a contextual campaign is a separate data flow, and section 1798.140(k) defines cross context behavioral advertising by where the data for targeting came from.

Other states draw the line explicitly. Virginia's targeted advertising definition (opens in a new tab) excludes "Advertisements based on the context of a consumer's current search query, visit to a website, or online application." The IP address page covers how both states define the identifiers that travel with any ad request.

What did California's 2026 regulations add?

On September 23, 2025 the CPPA announced (opens in a new tab) that the Office of Administrative Law had approved regulations on cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies and updates to existing CCPA rules, effective January 1, 2026. For advertising, the key line is section 7150(b)(1): "Selling or sharing personal information" is a processing activity that "presents significant risk to consumers' privacy" and requires a risk assessment before it starts.

The regulations in force also require a business to show the result of a signal: under section 7025(c)(6) it "must display whether it has processed the consumer's opt-out preference signal," for example with the words "Opt-Out Request Honored."

How do opt out signals reach the ad chain?

Section 7025(b) says a valid opt out preference signal is in "a format commonly used and recognized by businesses," such as "an HTTP header field or JavaScript object," and the CPPA FAQ (opens in a new tab) names the Global Privacy Control, defined in the W3C's GPC Working Draft (opens in a new tab) of September 24, 2026. The Global Privacy Control guide covers the signal itself; this section covers California's rules for it.

A business that receives the signal must treat it as an opt out "for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles," under section 7025(c)(1). In programmatic buying the publisher's page passes that choice on in the bid request. OpenRTB 2.6 (opens in a new tab) carries it in the Regs object, in the gpp field for the Global Privacy Platform string and gpp_sid for the applicable section, or in the us_privacy field.

IAB Tech Lab's GPP section list (opens in a new tab) gives California section ID 8, prefix usca. Its California specification includes a SharingOptOut field, where 1 means Opted Out and 2 means Did Not Opt Out, and a Gpc field that records whether the signal was present.

How does this look on a California campaign?

How does PlacementGraph build the contextual layer of a plan?