CPA defines any exchange of personal data for monetary or other valuable consideration by a controller to a third party as a sale. A controller is an entity that determines the purpose and means of processing personal data (very similar to the GDPR definition). So, your status as a controller depends on how you collect and use your visitor's data, but publishers are typically data controllers.