By Daniel de Almeida Afonso · Last updated: October 9, 2026
A CCPA service provider is a person that processes personal information on a business's behalf and receives it for a business purpose under a written contract that restricts how it can use the data. The California Privacy Rights Act (CPRA) amended the California Consumer Privacy Act (CCPA) and added a near-twin role called the contractor. Everyone else who receives the data is a third party.
Which label applies decides what the contract must say and whether the disclosure counts as a sale or sharing. This guide explains the three roles, the mandatory contract terms, and who is liable when a vendor misuses data. For the wider law, see our CCPA overview.
The three roles at a glance
California Civil Code section 1798.140 defines each role. The contract, not the vendor's own description of itself, decides which one applies.
| Service provider | Contractor | Third party | |
|---|---|---|---|
| Receives data for | A business purpose, on the business's behalf | A business purpose, under contract | Its own purposes |
| Written contract with set terms | Required | Required, plus a certification | Required if data is sold or shared |
| Is the transfer a "sale" or "sharing"? | No | No | Often yes |
| Consumer opt-out applies? | No | No | Yes, for sale or sharing |
Choose "service provider" or "contractor" only if the vendor acts for you under a compliant contract and uses the data for nothing else. Treat the vendor as a third party if it keeps the data for its own purposes, including cross-context behavioral advertising.
Who is a service provider?
Under section 1798.140(ag), a service provider is a person that does two things. It processes personal information on behalf of a business, and it receives that information from or for the business for a business purpose under a written contract.
The contract must prohibit the provider from:
- selling or sharing the personal information
- retaining, using or disclosing it for any purpose other than the business purposes in the contract
- retaining, using or disclosing it outside the direct business relationship
- combining it with personal information from other sources, except as the law and regulations allow
A service provider that hires its own subprocessor must notify the business and bind the subprocessor in writing to the same terms.
One older rule no longer applies. The 2020 version of this guide said a service provider must be a "for-profit legal entity". The current definition says "person". A person includes an individual, a proprietorship, a partnership, a company and other organizations.
What counts as a business purpose?
A business purpose is a use of personal information for the business's or the provider's operational purposes. The use must be reasonably necessary and proportionate to the purpose for which the data was collected, or to a compatible purpose. Section 1798.140(e) lists the purposes:
- auditing related to ad impressions, such as counting unique visitors and verifying ad quality
- helping ensure security and integrity
- debugging to repair errors that impair existing functionality
- short-term, transient use, such as non-personalized ads in the current interaction
- performing services for the business, such as customer service, order and payment processing, analytics and storage
- advertising and marketing services, except cross-context behavioral advertising
- internal research for technological development and demonstration
- verifying or maintaining the quality or safety of a service or device, and improving it
Two details matter in practice. Cross-context behavioral advertising is not a business purpose, so an ad vendor that does it is a third party for that work. And a provider must not combine the data of opted-out consumers with data from other sources when it provides advertising and marketing services.
What is a contractor, and how does it differ?
A contractor is a person to whom a business makes personal information available for a business purpose under a written contract (section 1798.140(j)). The prohibitions are the same as for service providers. The contractor definition adds two items: a certification that the contractor understands and will follow the restrictions, and a clause that lets the business monitor compliance, including by scans, assessments or audits at least every 12 months.
For most vendor reviews the two roles lead to the same contract. The practical test is simple. If the vendor processes data for you, use the service provider terms. If you only give it access for a business purpose, use the contractor terms. If you cannot tell, use the stricter set. Our CCPA vs CPRA comparison covers how the CPRA introduced this role.
Do not confuse the legal term with a freelancer. An independent contractor in the employment sense can be a service provider or a contractor, because "person" includes individuals and sole proprietors. The legal form does not matter. What matters is whether the written contract contains the required restrictions.
Who is a third party?
A third party is anyone who is not the business the consumer is dealing with, not your service provider and not your contractor (section 1798.140(ai)). Ad networks, data brokers and any recipient that uses the data for its own ends usually fall here.
Handing personal information to a third party can be a sale or sharing. Consumers then have the right to opt out, and your notices must say so. Our guide to CCPA and CPRA consent and opt-out rules covers the notice and opt-out side.
If you sell or share data with a third party, you still need a contract. Under section 1798.100(d) and 11 CCR 7053 it must name limited purposes, require the same level of privacy protection, let you verify and stop misuse, and require the third party to tell you if it can no longer comply.
What must the service provider contract say?
Section 1798.100(d) and the CPPA regulations at 11 CCR 7051 set the minimum. Under 7051(a) the contract must:
- Prohibit selling or sharing the personal information.
- Name the business purposes specifically. A generic reference to the whole contract is not enough.
- Prohibit retaining, using or disclosing the data for other purposes, including other commercial purposes.
- Prohibit use outside the direct business relationship, and combining the data with data from other sources unless the law permits it.
- Require compliance with the CCPA and the same level of privacy protection.
- Give the business the right to take reasonable steps to confirm compliance, such as scans and assessments.
- Require the provider to notify the business if it can no longer meet its obligations.
- Give the business the right, on notice, to stop and remediate unauthorized use.
- Require the provider to help with consumer requests, or have the business pass along each request.
The regulations also require a written contract with any subcontractor that meets the same standard. Missing terms have a real cost. Under 11 CCR 7050, a recipient without a compliant contract is not a service provider or contractor, and the disclosure may be treated as a sale or sharing.
If you also serve customers in Europe, see how this compares with GDPR-style data processing agreements.
What can a service provider do with the data?
Under 11 CCR 7050 a service provider or contractor may use the data only:
- for the business purposes in the contract
- to engage a compliant subcontractor
- for internal use to build or improve its own services, without using the data to serve another person
- to prevent, detect or investigate security incidents and fraud
- for the legal purposes listed in section 1798.145(a), such as complying with law and responding to lawful process
Consumer requests and deletion
A business that receives a verifiable deletion request must tell its service providers and contractors to delete the data (section 1798.105(c)). The provider must cooperate, delete or enable deletion, and pass the request to its own subprocessors. The same exceptions that let a business keep data also protect providers.
A provider that receives a request directly from a consumer does not have to act on it for data it holds only as a provider. It either follows the business's instructions or tells the consumer it cannot act because it is a service provider.
De-identified and aggregated data
The CCPA does not restrict businesses, providers or contractors from using de-identified or aggregate consumer information (section 1798.145(a)(6)). The conditions are strict. De-identified data must not be reasonably linkable to a consumer, and the holder must take reasonable measures, publicly commit not to re-identify it, and bind recipients by contract (section 1798.140(m)). Aggregate data must have individual identities removed. Before a provider relies on this carve-out, the contract should say whether it may be used at all.
Who is liable when a vendor misuses the data?
A business that discloses data to a service provider or contractor in compliance with the law is not liable for the vendor's violation, unless at the time of disclosure it had actual knowledge, or reason to believe, that the vendor intended to violate the law (section 1798.145(i)). Providers are likewise not liable for the business's own obligations, but each is liable for its own violations.
The "reason to believe" wording is why diligence matters. A business that never enforces its contract or audits its vendors may struggle to rely on this protection. The regulations say due diligence affects whether a business had reason to believe misuse was happening.
Penalties apply to businesses, service providers, contractors and other persons. The CPPA adjusted the amounts for inflation from January 1, 2025: up to $2,663 per violation, and up to $7,988 for each intentional violation or violation involving a consumer known to be under 16. The Attorney General and the CPPA both enforce. The automatic 30-day cure period that applied before 2023 no longer applies to regulator enforcement, so do not count on a window to fix a violation after the fact. The private right of action covers certain data breaches only, not vendor contract violations in general. The full statute text is summarized in our CPRA guide.
Does a service provider ever count as a business?
Yes. A service provider that is itself a "business" must comply with the CCPA for personal information it collects or uses outside its provider role (11 CCR 7050). The business test in section 1798.140(d) has three thresholds. An entity that does business in California and determines the purposes and means of processing is a business if it:
- had annual gross revenue above $26,625,000 (the 2025 inflation-adjusted figure, up from $25,000,000)
- buys, sells or shares the personal information of 100,000 or more consumers or households, up from 50,000 consumers, households or devices
- derives 50 percent or more of its annual revenue from selling or sharing personal information
If a provider uses the data for its own purposes, it is acting as a business or third party for that data. The contract and your due diligence should prevent that.
FAQ
Can an independent contractor be a service provider?
Yes. The statute says "person", which includes individuals and sole proprietors. A freelancer qualifies if the written contract has the required restrictions. Do not confuse this with the CPRA "contractor", which is a separate legal role.
Is a service provider a "seller" of personal information?
No. Disclosing data to a service provider or contractor under a compliant contract is not a sale or sharing, so the consumer's opt-out right does not apply to that disclosure.
Do deletion requests reach service providers?
Yes. The business must notify its service providers and contractors, and they must cooperate under section 1798.105(c). The usual exceptions apply to them too.
Can a service provider use data it has de-identified or aggregated?
The CCPA allows use of de-identified or aggregate information, but only if it meets the statutory definitions. Put the permission, or the ban, in the contract.
Is a business liable for its service provider's violations?
Not if it disclosed the data in compliance with the law and had no actual knowledge or reason to believe the vendor would violate it. Due diligence and contract enforcement support that position.
When does a service provider stop being a service provider?
When it has no compliant written contract, or uses the data outside the contract for its own purposes. The disclosure may then be treated as a sale or sharing, and the recipient is regulated as a business or third party for that use.
What are the penalties?
Up to $2,663 per violation and $7,988 per intentional violation or violation involving a consumer known to be under 16, as adjusted for 2025. The next scheduled adjustment is January 1, 2027.
