US CPRA Contracts Contractors and Service Providers

A service provider processes personal information on behalf of a business under a written contract. A contractor is a person to whom the business makes personal information available for a business purpose under a qualifying written contract and certification. Both roles are subject to purpose, use, disclosure, sale, sharing, combination, and direct-business-relationship restrictions.

A person without a contract that complies with regulation section 7051 is not a service provider or contractor for that processing. The same is true when the recipient provides cross-context behavioral advertising services to the business. Contextual advertising based on the page's subject or aggregated demographics can fit a service relationship when the other tests are met; using the business's customer list to identify those people on another platform for cross-context behavioral advertising cannot. If a recipient uses personal information outside the contract, the business and recipient must analyze the consequences under the sale, sharing, and third-party rules.

Subcontracting does not remove the restrictions. A service provider or contractor must bind a subcontractor to a CCPA-compliant agreement and follow the business's contract requirements for engaging it. The original recipient remains responsible for using the data only within permitted purposes.

The business owner describes the service and actual uses; privacy or legal classifies the recipient; procurement secures the terms before disclosure; and data, product, and security teams enforce instructions and monitoring. No single contract label should replace that cross-functional decision.

Keep a role memorandum or intake record, executed agreement, data-flow diagram, purpose and category schedule, subcontractor list, opt-out and consumer-request instructions, assessment results, incidents, remediation, and deletion or return evidence. Review the role when the service, purpose, data, advertising activity, or recipient's own use changes.

A recipient can have different roles for different processing. Classify each data flow and purpose instead of assigning one permanent label to the company. A compliant service-provider relationship for hosting does not automatically cover the recipient's advertising or product-development uses.

Internal use to improve the quality of services is limited by the regulations and does not permit building or modifying household or consumer profiles for another business or cleaning or augmenting data acquired from another source. For example, an email provider may analyze interactions to improve its email service but may not reuse the original customer list to send another business's marketing; a shipping provider may use delivery experience to identify faulty addresses but may not compile client addresses for advertising or sale to data brokers. Security and fraud-prevention uses also remain subject to the stated purpose and legal limits.

Disclosures directed by the consumer or intentional consumer interactions with a third party may fall outside sale or sharing definitions when statutory conditions are met. Record the consumer action and the recipient identity rather than assuming every integration qualifies.

Use a recipient register with one row per purpose and data flow. Record the California role, sale or sharing result, contract section, consumer-choice dependency, systems, subcontractors, retention, request route, assurance evidence, and review trigger.

When the recipient cannot comply, stop the affected disclosure or use, investigate the scope, preserve evidence, remediate the data and contract position, and reassess notices and consumer instructions. The CCPA contract right to remediate must be usable in practice.