US CCPA Contract Classification Workflow

Run the workflow by deciding whether the counterparty is a service provider, contractor, or third party, then confirm the contract terms and permitted use match that classification. A person with a written contract under section 7051 is treated as a service provider or contractor only if the contract limits use to the specific business purpose, prohibits sale or sharing, and keeps the relationship inside the direct business relationship. If the arrangement is for a third party, the agreement under section 7053 must identify a limited and specified purpose for making personal information available. If there is no compliant section 7051 contract, the disclosure may be a sale or sharing and the workflow should route it for opt-out review.

A useful template captures threshold, consumer/data category, request or signal type, notice location, vendor role, response deadline, evidence link, and escalation reason.

Review the workflow after CPPA updates, ad-tech changes, new collection points, vendor changes, consumer complaints, enforcement advisories, or material product changes.