1. (a) "Sale of personal data" means the exchange of personal data for monetary consideration by a controller to a third party.

2. (b) The term does not include:

   1. (1) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;

   2. (2) the disclosure of personal data to a third party for purposes of providing a product or service requested by:

      1. (A) the consumer; or

      2. (B) the parent of a child;

         to whom the personal data pertains;

   3. (3) the disclosure or transfer of personal data to an affiliate of the controller;

   4. (4) the disclosure of information that the consumer:

      1. (A) intentionally made available to the general public via a channel of mass media; and
      2. (B) did not restrict to a specific audience; or
   5. (5) the disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

As added by P.L.94-2023, SEC.1.