CCPA service provider vs contractor vs third party: what decides the role

A client's security questionnaire asks: "Are you a service provider, contractor or third party under the CCPA?" Or a client's counsel insists on one label in the contract. If you run a data or API business, the answer shapes what you can do with the data and what paper you have to send.

This page sets the three CCPA roles side by side, from the vendor's side. It covers the statutory definitions, the contract each role needs, and the limit on cross-context behavioral advertising that matters most to media and ad-data vendors. It explains the tests; which role applies to your business is a question for your counsel.

A vendor doesn't become a service provider by saying so in a questionnaire. The regulations tie the role to the paper. Section 7050(e) reads:

"A person who does not have a contract that complies with section 7051, subsection (a), is not a service provider or a contractor under the CCPA. For example, a business's disclosure of personal information to a person who does not have a contract that complies with section 7051, subsection (a), may be considered a sale or sharing of personal information for which the business must provide the consumer with the right to opt-out of sale/sharing."

That is why clients push for the paper. If the contract is missing or incomplete, your client may have a sale or sharing on its hands, with the opt-out obligations that come with it. The statute builds the same test into the definitions: a service provider and a contractor are each defined by a written contract containing specific prohibitions (Civ. Code § 1798.140(ag)(1) and (j)(1)).

The nine terms a § 7051(a) contract must contain are covered in what US state privacy laws require in a processor contract. The difference worth knowing here: the statute's contractor definition also requires "a certification made by the contractor that the contractor understands the restrictions" and will comply with them (§ 1798.140(j)(1)(B)). The service-provider definition has no such certification.

A business that sells or shares personal information with a third party must have an agreement with it. Section 7053(a) lists six terms. The agreement must:

1. identify the "limited and specified purpose(s)" for which the information is made available, described specifically rather than "referencing the entire contract generally";
2. specify that the information is made available only for those purposes, and require the third party to use it only for them;
3. require the third party to comply with the CCPA and the regulations, including providing "the same level of privacy protection as required of businesses";
4. grant the business the right to take reasonable and appropriate steps to ensure the third party uses the information consistently with the business's obligations;
5. grant the business the right, upon notice, to stop and remediate unauthorized use;
6. require the third party to notify the business if it determines it can no longer meet its obligations.

Without such a contract, § 7052(a) says the third party "shall not collect, use, process, retain, sell, or share the personal information that the business made available to it." And § 7053(b) adds that a business that "never enforces the terms of the contract" may not be able to rely on the defense that it had no reason to believe the third party would misuse the data.

Cross-context behavioral advertising is the one service a service provider or contractor can't provide. Section 7050(b) says:

"A service provider or contractor cannot contract with a business to provide cross-context behavioral advertising."

It continues: a service provider or contractor "may contract with a business to provide advertising and marketing services", but it "shall not combine the personal information of consumers who have opted-out of the sale/sharing" that it receives from the business with personal information it receives from another person or collects itself. And: "A person who contracts with a business to provide cross-context behavioral advertising is a third party and not a service provider or contractor with respect to cross-context behavioral advertising services."

The statute defines cross-context behavioral advertising as "the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded internet websites, applications, or services" other than the one the consumer intentionally interacts with (Civ. Code § 1798.140(k)).

The regulation's own examples draw the line. A social media company acting as a service provider can serve a clothing company's ads to an audience based on aggregated or demographic information, "However, it cannot use a list of customer email addresses provided by Business S to identify users on the social media company's platform to serve advertisements to them." An advertising company can place a cookware brand's ads on recipe websites as contextual advertising.

So a media or ad-data vendor may be a service provider for one service and a third party for another, under the same client relationship. Which side of the line a given service falls on is a question for counsel.

Once you know which terms each client relationship needs, the work is getting every client onto them and keeping them current. California is the focus here; other states use "processor" and "third party" differently, and the state-by-state contract requirements guide sets them out.

Yesmark handles the sending. You put your service-provider terms on Yesmark as one standard text, and each client contact gets a private link to a page where they read and accept it, with no account. When the terms change and you publish a material new version, Yesmark drafts a re-acceptance campaign to every client not yet on it. The coverage board shows which clients are on the current version and which aren't. Yesmark for data and API vendors shows the setup, and when a client asks if you're a CCPA service provider covers that moment.