California Consumer Privacy Act, definition of deidentified (Cal. Civ. Code 1798.140(m))
Data counts as deidentified (and outside the CCPA's personal information rules) only with all three: reasonable technical measures, a public no-re-identification commitment, and contracts binding every recipient.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(1) Takes reasonable measures to ensure that the information cannot be associated with a consumer or household. (2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information ... (3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision.”
Where it was read
Also read from the same source
- California Consumer Privacy Act, definition of sell (Cal. Civ. Code 1798.140(ad)(1))
- California Consumer Privacy Act, transfer in a merger, acquisition or bankruptcy is not a sale (Cal. Civ. Code 1798.140(ad)(2)(C))
- California Consumer Privacy Act, definition of service provider (Cal. Civ. Code 1798.140(ag)(1))
- California Consumer Privacy Act, right to opt out of sale or sharing (Cal. Civ. Code 1798.120(a))
- California Consumer Privacy Act, right to limit use and disclosure of sensitive personal information (Cal. Civ. Code 1798.121(a))
- California Consumer Privacy Act, definition of sensitive personal information (contents of messages) (Cal. Civ. Code 1798.140(ae)(1)(E))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides