; and (B) includes an online means of exercising such right or engaging in such interaction, if such individuals communicate or interact with such covered entity through an online medium or if such covered entity provides information processing services through a public or widely available application programming interface (or similar mechanism). (20) Sell and sale (A) In general The terms sell and sale means the disclosure of personal information for monetary consideration by a covered entity to a third party for the purposes of processing, maintaining or disclosing such personal information at the third party’s discretion. (B) Exclusions The terms sell and sale do not include— (i) the disclosure of personal data to a third party with which the individual has a direct relationship for purposes of providing a product or service requested by the individual or otherwise in a manner that is consistent with an individual’s reasonable expectations considering the context in which the individual provided the personal information to the covered entity; (ii) the disclosure or transfer of personal information to a subsidiary or an affiliate of the covered entity; or (iii) the disclosure or transfer of personal information to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the covered entity’s assets, unless such assets are limited to personal information unless personal information makes up the majority of the value of such assets. (21) Service provider (A) In general The term service provider means a covered entity who— (i) processes, discloses, or maintains personal information, where such person does not process, disclose, or maintain the personal information other than in accordance with the directions and on behalf of another covered entity; (ii) does not directly collect personal information from or control the mechanism for collecting personal information from an individual