A CCPA service provider is an outside person or company that processes personal information on behalf of a California business under a written contract that restricts how the data can be used. The label matters because data sent to a qualifying service provider is not treated as a “sale” or “share” under California privacy law, so the transfer does not trigger consumer opt-out rights. Whether an entity actually qualifies turns almost entirely on the contract: miss a required clause, and the relationship can be reclassified as a third-party disclosure, with penalties and opt-out demands following.
Who Qualifies
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, a service provider is any person that processes personal information on behalf of a business and receives that information for a business purpose under a written contract.1California Legislative Information. California Civil Code 1798.140 – Definitions The contract must prohibit the service provider from selling or sharing the data, using it outside the direct business relationship, or combining it with data from other sources.
“Business purpose” is defined broadly enough to cover most operational outsourcing: auditing and ad measurement, security, debugging, short-term transient use, services like payment processing and customer support, advertising and marketing (with an important exception for cross-context behavioral advertising), internal research, and quality assurance.2California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Full Text If the reason data moves to an outside company fits one of those categories and the contract meets every statutory requirement, the entity qualifies.
The practical test is whether the entity acts as an extension of the business rather than pursuing its own interests with the data. A cloud host storing customer records, a payment processor handling transactions, an analytics firm running reports for a single client — classic examples. The moment that entity starts using the data to benefit another client, build its own consumer profiles, or sell insights, the relationship breaks.
Why the Classification Matters
The CCPA defines a “sale” as disclosing personal information to a third party for monetary or other valuable consideration, and defines “sharing” as disclosing it to a third party for cross-context behavioral advertising. Both definitions turn on the words “third party.” The statute explicitly excludes service providers and contractors from that definition.3California Legislative Information. California Civil Code 1798.140 – Definitions
Mechanically, that means a disclosure to a qualifying service provider cannot be a sale or a share. The business does not need to offer consumers an opt-out for the transfer, and the transfer does not have to appear in “Do Not Sell or Share My Personal Information” disclosures. Routine operations like processing payments, storing data in the cloud, or running analytics proceed without consumer intervention.
The protection evaporates the moment the contract or the behavior stops meeting the statute. If a company labels a partner as a service provider but the agreement lacks the required prohibition on commingling, or the partner is actually using the data for its own marketing, the entity becomes a third party again. The data disclosure becomes a sale, and every consumer whose information was transferred without an opt-out opportunity represents a separate potential violation.
Required Contract Provisions
Without a contract that hits every statutory requirement, the entity on the receiving end of the data transfer is a third party by default. California law imposes two overlapping layers of contract requirements: one built into the service provider definition itself, and another that applies to any business disclosing personal information to a service provider.
Restrictions Built Into the Definition
The contract must prohibit the service provider from four specific activities:1California Legislative Information. California Civil Code 1798.140 – Definitions
- Selling or sharing the personal information it receives from the business.
- Retaining, using, or disclosing the data for any purpose other than the business purposes specified in the contract, including any separate commercial purpose.
- Retaining, using, or disclosing the data outside the direct business relationship with the disclosing business.
- Combining data received from one business with data received from another person or collected from its own consumer interactions, except in narrow circumstances defined by regulation.
If any of these four prohibitions is missing, the entity does not meet the statutory definition of a service provider.
Provisions Required on the Disclosure Side
A separate statute requires any business disclosing personal information to a service provider to include five additional provisions in the agreement:4California Legislative Information. California Civil Code 1798.100 – General Duties of Businesses That Collect Personal Information
- A statement that personal information is disclosed only for limited and specified purposes.
- A requirement that the service provider comply with all applicable CCPA obligations and provide the same level of privacy protection the statute requires.
- The business’s right to take reasonable steps to ensure the service provider handles data consistently with the business’s own legal obligations.
- A duty for the service provider to notify the business if it determines it can no longer meet its obligations under the statute.
- The business’s right, upon notice, to take reasonable steps to stop and fix any unauthorized use of personal information.
Missing one of these clauses will not necessarily strip the entity of its service provider status (that depends on the definitional requirements), but it puts the business out of compliance with its own disclosure obligations.
What a Service Provider Cannot Do With the Data
The restrictions baked into the definition are not just contract boilerplate. They define the boundaries of what the entity can actually do with the data day to day.
Commingling
The commingling rule is probably the most operationally disruptive. A service provider cannot mix personal information received from one business with data received from a different business or data the provider collects from its own consumer interactions.1California Legislative Information. California Civil Code 1798.140 – Definitions For analytics providers and ad tech companies that serve multiple clients, that means maintaining strict data silos. You cannot use Client A’s consumer data to improve models for Client B, and you cannot enrich a business’s customer data with information collected independently. Narrow exceptions exist for business purposes defined in CPPA regulations, but separation is the default.
Cross-Context Behavioral Advertising
The statute explicitly carves cross-context behavioral advertising out of the permissible business purposes for which a service provider can use data. Cross-context behavioral advertising means targeting ads to a consumer based on personal information gathered from that consumer’s activity across different businesses or websites.3California Legislative Information. California Civil Code 1798.140 – Definitions A service provider can help a business run its own advertising and marketing, but it cannot use the data it receives to track consumers across other clients’ platforms and serve targeted ads based on that cross-platform profile. An ad tech company that receives data from a retailer under a service provider agreement and then uses it to target ads on an unrelated news site has crossed the line.
Service Providers, Contractors, and Third Parties
The CPRA introduced a second trusted-partner category called a “contractor,” and the two are easy to confuse. A service provider processes personal information on behalf of a business. A contractor is a person to whom the business makes personal information available for a business purpose.1California Legislative Information. California Civil Code 1798.140 – Definitions Service providers tend to perform data-centric processing like hosting, analytics, and payment handling; contractors provide services where personal information access is more incidental.
Both categories carry nearly identical contractual restrictions. The procedural differences are two. First, a contractor’s contract must include a certification that the contractor understands and will comply with the restrictions; the statute does not impose the same certification requirement on service providers. Second, for contractors the contract must permit the business to monitor compliance; for service providers, monitoring is framed as permissive, using “may” rather than mandatory language.
A “third party” is anyone who is not the business itself, a service provider, or a contractor. Disclosures to a third party for consideration are sales, and disclosures to a third party for cross-context behavioral advertising are shares. Both trigger consumer opt-out rights.
Consumer Requests and Sub-Processors
Service providers do not interact directly with consumers for CCPA purposes. If a consumer submits a deletion, access, or correction request to a service provider, the provider can redirect them to the business.5California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information
Behind the scenes, cooperation obligations are significant. When the business receives a verified deletion request, the service provider must, at the business’s direction, delete the consumer’s personal information from its systems or enable the business to do so. The service provider must also tell its own sub-processors to delete the data, and notify any other service providers, contractors, or third parties that may have accessed the information through it.5California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information Similar cooperation duties apply to access and correction requests. The contract should spell out how these handoffs work.6California Privacy Protection Agency. California Consumer Privacy Act Regulations
Sub-processors fall under their own rule. If a service provider engages another person to help process personal information on behalf of the business, it must notify the business of the engagement, and the sub-processor must be bound by a written contract imposing the same restrictions that apply to the service provider itself.1California Legislative Information. California Civil Code 1798.140 – Definitions The requirement flows down through every layer of the chain, so personal information should never reach an entity that is not bound by the full set of service provider restrictions.
Penalties for Getting It Wrong
Service providers face direct enforcement. The statute applies its civil penalty provisions to “any business, service provider, contractor, or other person” that violates the law.7California Legislative Information. California Civil Code 1798.199.90 – Civil Penalties A service provider that ignores its contractual restrictions can be sued directly by the Attorney General, not just dropped by the business.
The base statutory penalties are $2,500 per violation and $7,500 per intentional violation or violation involving the personal information of a consumer under 16, adjusted for inflation. As of the adjustment effective January 1, 2025, the penalties are $2,663 per violation and $7,988 per intentional violation.8California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties Because penalties are assessed per violation, a service provider that misuses data affecting thousands of consumers faces exposure that scales rapidly.
A business that disclosed data to a service provider is not automatically liable for the service provider’s violations, provided the business did not have actual knowledge or reason to believe the service provider intended to violate the law at the time of disclosure. That shield depends on the business having done its contractual homework. A contract missing required provisions, or a business that ignores red flags about a provider’s practices, weakens the argument that the business had no reason to suspect problems.