The INCDPA defines the sale of data strictly as the exchange of personal data for money by a controller to a third party, similar to the laws in Virginia, Utah, and Iowa. These laws differ from data privacy laws in California, Connecticut, and Colorado, which define the sale of personal data to include valuable consideration other than money.