What is Cross-Context Behavioral Advertising?
Also known as: CCBA, Cross-Context Behavioral Advertising, Cross-Site Behavioral Advertising, Behavioral Advertising
Under the California Consumer Privacy Act (CCPA), cross-context behavioral advertising is specifically defined around advertising targeted using personal information obtained from a consumer's activity across businesses, distinctly branded websites, applications, or services other than the business or service with which the consumer intentionally interacts.
The concept is important because the CCPA gives consumers the right to opt out of the sharing of their personal information for cross-context behavioral advertising. Businesses subject to the CCPA must therefore ensure that applicable opt-out choices and signals are actually respected by their advertising and tracking technologies.
What does Cross-Context Behavioral Advertising mean?
Cross-context behavioral advertising occurs when information about a consumer's activity in one context is used to target advertising to that consumer in another context.
For example:
Visit
A consumer visits Website A.
Record
A tracking technology records information about the consumer's activity.
Share
The information is made available to an advertising or technology company.
Move on
The consumer later visits Website B.
Target
Advertising is targeted based on information associated with the consumer's activity across those different contexts.
The important element is the cross-context use of information for advertising targeting.
It is therefore broader than simply showing a personalised advertisement based on activity occurring entirely within one website.
What is an example of Cross-Context Behavioral Advertising?
Imagine a consumer visits an online furniture retailer and looks at several sofas.
A third-party advertising technology records information about that activity.
Later, the consumer visits a separate website and sees advertisements for the same furniture retailer or related products.
If the advertising is targeted using the consumer's personal information obtained from activity across different businesses, websites, applications or services, the activity may fall within the CCPA's definition of cross-context behavioral advertising.
The exact legal classification of a particular advertising practice depends on the facts and applicable law.
Why is Cross-Context Behavioral Advertising important under CCPA?
Cross-context behavioral advertising is particularly important under the CCPA because California consumers have the right to opt out of the sharing of their personal information for cross-context behavioral advertising.
For businesses, this means privacy compliance cannot stop at publishing a privacy policy.
If a consumer opts out, the organisation needs to ensure that the applicable preference is communicated to and respected by the technologies involved in advertising and data sharing.
These technologies can include:
- Advertising pixels
- Retargeting scripts
- Third-party cookies
- Advertising SDKs
- Social-media pixels
- Conversion and audience tags
- Customer-data integrations
- Ad-tech platforms
- Cross-site identifiers
What does "sharing" mean for Cross-Context Behavioral Advertising?
Under the CCPA, sharing has a specific statutory meaning that is particularly relevant to cross-context behavioral advertising.
The concept covers the communication of a consumer's personal information to a third party for cross-context behavioral advertising.
This is why a business can have CCPA obligations even where it does not think of its advertising activity as a traditional "sale" of personal information.
The CCPA separately gives consumers a right to opt out of the sale of personal information and a right to opt out of sharing personal information for cross-context behavioral advertising.
Is Cross-Context Behavioral Advertising the same as selling personal information?
No.
Selling and sharing are separate concepts under the CCPA.
A business may have an obligation to honour a consumer's opt-out even where the relevant activity is classified as sharing for cross-context behavioral advertising rather than a sale.
This distinction is especially important for digital advertising because personal information may be transferred or made available to advertising platforms without money changing hands directly between the parties.
Businesses should therefore evaluate both their sale and sharing activities when assessing CCPA compliance.
Cross-Context Behavioral Advertising and cookies
Cookies are one technology that can facilitate cross-context behavioral advertising, but CCBA is not limited to cookies.
Other technologies can include:
- Pixels
- JavaScript tags
- SDKs
- Local storage
- Advertising IDs
- Device identifiers
- Server-side tracking
- Identity-resolution technologies
- Other tracking mechanisms
The legal question is not simply:
"Is this a cookie?"
The more useful question is:
"What personal information does this technology collect, where does it go, and how is it used for advertising?"
This is why websites should maintain visibility into the actual scripts and third-party technologies running on their properties.
Does Cross-Context Behavioral Advertising require consent?
Under the CCPA, the key consumer control is generally the right to opt out of sale or sharing, rather than a GDPR-style requirement to obtain prior consent for every instance of targeted advertising.
This distinction matters.
A CCPA implementation may therefore need to:
- Detect the consumer's opt-out choice.
- Detect applicable opt-out preference signals.
- Stop applicable sharing.
- Prevent advertising technologies from receiving information covered by the opt-out.
- Apply the preference consistently across relevant systems.
Other privacy laws may impose different requirements.
For example, a website serving EU users may have separate obligations under the GDPR and ePrivacy framework.
What is Global Privacy Control (GPC)?
Global Privacy Control (GPC) is a browser or user-agent privacy signal that communicates a consumer's opt-out preference.
Under the CCPA, qualifying opt-out preference signals can allow consumers to exercise their right to opt out of the sale or sharing of their personal information.
The current CCPA regulations contain detailed examples concerning how businesses should handle opt-out preference signals, including situations involving browsers, accounts and different devices.
This makes GPC an important technical component of CCPA privacy compliance.
How does GPC affect Cross-Context Behavioral Advertising?
When a covered business receives a valid opt-out preference signal, it may need to stop applicable selling or sharing of personal information for cross-context behavioral advertising.
For example, the current CCPA regulations describe situations in which a business receiving an opt-out signal must stop selling or sharing information associated with the consumer's browser identifier for cross-context behavioral advertising.
The implementation can become more complex when the business also knows the consumer through an account or other identifier.
This is why GPC support should be implemented as a real privacy control rather than treated as a decorative browser feature.
Cross-Context Behavioral Advertising and third parties
Third parties play an important role in many advertising ecosystems.
A business may use third-party advertising platforms to:
- Build or activate audiences
- Display targeted advertising
- Measure campaigns
- Retarget website visitors
- Create advertising profiles
- Match identifiers
- Deliver personalised advertising
Under the CCPA regulations, a service provider or contractor cannot contract with a business to provide cross-context behavioral advertising. A party providing such services is treated as a third party for that activity rather than as a service provider or contractor for the CCBA service.
This distinction matters when businesses assess their advertising vendors and data-sharing arrangements.
Cross-Context Behavioral Advertising vs first-party advertising
First-party advertising
First-party advertising generally involves using information within the business's own relationship or context.
For example:
An online retailer recommends products based on products a customer previously viewed on that retailer's own website.
Cross-context behavioral advertising
Cross-context behavioral advertising involves using personal information obtained from activity across different businesses, websites, applications or services to target advertising.
For example:
An advertising platform uses information about a consumer's activity on one website to target that consumer with advertising on another website.
The distinction is important because the CCPA's statutory definition specifically focuses on activity across different contexts.
Cross-Context Behavioral Advertising vs contextual advertising
| Cross-context behavioral advertising | Contextual advertising |
|---|---|
| Uses information about activity across different contexts | Uses the context of the current page or environment |
| Can involve third-party advertising technology | Can operate without cross-site behavioural profiles |
| Can involve personal information obtained from other businesses or services | Can target based on page content |
| Relevant to CCPA sale/sharing opt-out rights | Not automatically CCBA |
| Often associated with retargeting and audience targeting | Commonly associated with content-based advertising |
The same advertising campaign can involve multiple technologies, so businesses should evaluate the underlying data flows rather than classifying an entire advertising strategy with a single label.
What should businesses do if a consumer opts out?
When a consumer opts out of applicable sale or sharing, businesses should ensure that the privacy preference is technically enforced.
A practical workflow is:
Receive
Receive the opt-out request.
Detect
Detect applicable GPC or other opt-out preference signals.
Record
Record the privacy preference.
Update
Update the consumer's applicable privacy state.
Prevent
Prevent relevant data sharing.
Restrict
Restrict advertising technologies affected by the opt-out.
Propagate
Propagate the preference to relevant systems and vendors.
Evidence
Maintain evidence of the preference and its enforcement.
Test
Test the implementation regularly.
The important point is that an opt-out should affect the underlying data flow, not merely change the appearance of a privacy settings page.
What happens if tracking continues after an opt-out?
If a website continues sending applicable personal information to advertising technologies after a consumer has exercised an opt-out, there can be a disconnect between the consumer's stated privacy preference and the website's technical behaviour.
For example, a website might:
- Display a "Do Not Sell or Share" link.
- Receive a consumer's opt-out.
- Store the preference in a database.
- Continue firing advertising pixels regardless.
That implementation may fail to meaningfully enforce the consumer's choice.
The CCPA framework places importance on businesses honouring applicable consumer privacy rights, making technical enforcement a critical part of a privacy programme.
How can businesses detect Cross-Context Behavioral Advertising?
Businesses can begin by identifying the technologies running on their websites and applications.
A privacy technology inventory should examine:
- Cookies
- Scripts
- Pixels
- SDKs
- Network requests
- Third-party domains
- Advertising platforms
- Data-sharing destinations
- Identifiers passed to third parties
The next step is to determine:
- What data is collected?
- Who receives it?
- Why is it received?
- Is it used for advertising?
- Does the activity involve multiple businesses, websites, apps or services?
- What happens when the consumer opts out?
Automated website scanning can help identify unexpected advertising technologies and changes to the site's tracking environment.
How ConsentX helps with Cross-Context Behavioral Advertising
ConsentX helps organisations identify and control tracking technologies that may participate in advertising and data-sharing workflows.
Relevant capabilities include:
Tracker and cookie discovery
Third-party technology detection
Global Privacy Control support
Privacy preference management
Opt-out enforcement
Prior-script blocking
Consent and privacy records
Audit evidence
The current ConsentX glossary page specifically positions the platform around detecting trackers associated with cross-context advertising, honouring GPC and maintaining tamper-evident opt-out records.
The goal is to connect the consumer's privacy choice with the actual technical behaviour of the website.
Cross-Context Behavioral Advertising and ConsentX
A privacy preference is only useful if the underlying technologies respect it.
ConsentX can help create a workflow in which:
- Consumer preference
- Privacy state
- Tracker control
- Vendor enforcement
- Audit evidence
This provides a stronger implementation than simply placing a privacy link on a website.
For CCPA use cases, the relevant objective is to ensure that applicable sale/sharing opt-outs are reflected in the technologies and third parties involved in cross-context behavioral advertising.
Is Cross-Context Behavioral Advertising illegal?
No.
Cross-context behavioral advertising is not automatically illegal.
The CCPA establishes specific consumer rights and obligations concerning the collection, sale and sharing of personal information, including the right to opt out of sharing for cross-context behavioral advertising.
The compliance question is whether the business's practices satisfy the applicable legal requirements and whether consumer privacy choices are properly honoured.
A business should therefore avoid treating CCBA as something that is inherently prohibited.
Instead, it should understand:
- What information is collected.
- How it is used.
- Which parties receive it.
- Whether the activity constitutes sale or sharing.
- What consumer rights apply.
- How opt-out requests are implemented.
- Whether applicable privacy signals are honoured.
Does Cross-Context Behavioral Advertising apply outside California?
The term is most strongly associated with the California CCPA/CPRA framework, where it has a specific statutory definition.
Other US state privacy laws use related concepts such as targeted advertising and may provide consumers with similar opt-out rights.
However, the definitions and requirements are not necessarily identical.
Businesses operating across multiple US states should therefore avoid assuming that a CCPA CCBA implementation automatically satisfies every other state privacy law.
Cross-Context Behavioral Advertising and other US privacy laws
Several US state privacy frameworks address targeted or behavioural advertising.
The terminology can differ:
- California: Cross-context behavioral advertising
- Virginia: Targeted advertising
- Colorado: Targeted advertising
- Connecticut: Targeted advertising
- Other states may use similar or related terminology
The legal definitions and implementation requirements can vary by jurisdiction.
A multi-state privacy platform should therefore use jurisdiction-aware rules rather than applying one universal privacy preference to every visitor.
Cross-Context Behavioral Advertising compliance checklist
A practical compliance review should include:
- Identify advertising and retargeting technologies.
- Identify third parties receiving consumer information.
- Map cookies, pixels, scripts and SDKs.
- Determine whether personal information is used for cross-context behavioral advertising.
- Determine whether the activity constitutes CCPA "sharing."
- Provide the required opt-out mechanism.
- Support applicable Global Privacy Control signals.
- Stop applicable sharing after an opt-out.
- Propagate privacy preferences to relevant systems.
- Review advertising vendors and contracts.
- Test tracking behaviour after an opt-out.
- Maintain evidence of privacy preferences.
- Re-scan the website when advertising technologies change.
- Evaluate requirements in other states and jurisdictions.
Key takeaways
Cross-context behavioral advertising (CCBA) is advertising targeted using personal information obtained from a consumer's activity across different businesses, websites, applications or services.
The most important points are:
- CCBA has a specific definition under the CCPA.
- It is closely associated with third-party advertising and cross-site data use.
- Retargeting can qualify as CCBA, depending on the facts.
- Contextual advertising is different because it can rely on the content of the current environment rather than cross-context behavioural information.
- CCPA consumers have the right to opt out of sharing their personal information for CCBA.
- Global Privacy Control is an important mechanism for communicating opt-out preferences.
- Businesses need to technically enforce applicable opt-outs.
- Advertising vendors and third-party relationships should be reviewed carefully.
- CCBA is not automatically illegal, but applicable CCPA requirements must be satisfied.
- A privacy preference should affect the underlying data flow, not merely the user interface.
Make advertising privacy preferences enforceable
Cross-context behavioral advertising compliance is not simply about adding a "Do Not Sell or Share" link. Businesses need to understand which technologies collect personal information, which third parties receive it, and what happens after a consumer opts out. ConsentX helps organisations detect tracking technologies, honour applicable privacy signals and turn consumer privacy choices into enforceable, auditable controls. Make your website's privacy preferences technically enforceable with ConsentX.
Related Terms
California's comprehensive consumer privacy law, as amended by the CPRA.
A browser or user-agent signal that communicates a consumer's privacy preference.
A CCPA privacy choice allowing consumers to opt out of applicable sale or sharing of personal information.
A broader term used by several US state privacy laws for advertising based on information about a consumer's activities or interests.
A mechanism for obtaining and managing permission for cookies and trackers where consent is required.
Technology used to manage consent and privacy preferences across websites.
The practice of preventing relevant non-essential processing until the required consent has been obtained.
Advertising that targets users based on previous interactions, which can in some circumstances involve cross-context behavioral advertising.
An interface where users can review and modify privacy choices.