No-Sell No-Share U.S. State Assertion

What it is

Replicate states it does not sell or share your personal information as those terms are defined under U.S. state privacy laws such as the CCPA.

Why it matters (compliance & governance perspective)

This designation has practical significance for California and other state residents because it asserts no opt-out rights for data sale or sharing are triggered, though the accuracy of the processor or service provider designation depends on how data actually flows in practice.

Consumer impact (what this means for users)

California and other U.S. state residents may not have opt-out rights for data sale or sharing based on this assertion, as the policy claims Replicate does not engage in those activities as legally defined; however, users who believe their data is being used in ways inconsistent with this statement may file a complaint with a state attorney general.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: The CCPA/CPRA and analogous state laws define 'sale' and 'sharing' specifically, including cross-context behavioral advertising as 'sharing' under CPRA. The California Privacy Protection Agency and State Attorneys General enforce these provisions. The assertion that Replicate acts as a 'processor' or 'service provider' is legally significant under CCPA because service providers are exempt from certain consumer rights obligations, but only if a written contract meeting statutory requirements is in place. GOVERNANCE EXPOSURE: Medium. The self-designation as processor or service provider is a legally meaningful assertion under CCPA/CPRA but is stated without reference to the required contractual framework. If Replicate's analytics and advertising vendor relationships involve cross-context behavioral advertising, the no-share assertion may warrant independent verification. JURISDICTION FLAGS: California presents the highest exposure given CPRA's broad definition of 'sharing' to include cross-context behavioral advertising. Virginia, Colorado, Texas, and other state privacy laws also apply analogous definitions. The processor designation may have different implications under GDPR's Article 28 controller-processor framework for EU users. CONTRACT AND VENDOR IMPLICATIONS: B2B customers relying on Replicate's service provider designation to satisfy their own CCPA compliance obligations should verify that a compliant data processing or service provider agreement is in place. Without a qualifying written contract, Replicate may not qualify for the service provider exemption under CCPA. COMPLIANCE CONSIDERATIONS: Compliance teams should audit Replicate's third-party integrations, particularly analytics and advertising tools, to confirm that no data flows constitute 'sharing' under CPRA's definition. The absence of a stated contractual basis for the processor designation warrants follow-up in vendor assessments.

Applicable agencies

Provision details

Other risks in this policy

• Training Data Collection high
• Business Transition Data Sharing medium
• Data Retention Policy medium
• Policy Change Without Prior Notice medium
• Third-Party Professional Data Enrichment medium
• Children's Privacy low