CCPA considers “unique personal identifiers” such as cookies that can be used to “recognize a . . . device that is linked to a consumer or family, over time and across different services” as personal information. Since this definition is very broad, cookies can be considered personal information. Depending on how the cookie categories are used by your business, certain first-party cookies and third-party cookies used for advertising or marketing purposes can be interpreted as ‘sale’ of personal information as per the CCPA.