The California Consumer Privacy Act (CCPA), substantially amended and expanded by the California Privacy Rights Act (CPRA) that voters approved as Proposition 24 in November 2020, is a consumer-privacy statute, not a TPRM-specific law, but its vendor mechanics are some of the most granular of any US privacy regime. Most CPRA amendments became operative January 1, 2023, with enforcement by the California Privacy Protection Agency (CPPA), the regulator the CPRA created, beginning July 1, 2023. The law applies to a for-profit business doing business in California that meets at least one of three thresholds in Civil Code §1798.140(d): annual gross revenue above $25 million, as adjusted for inflation; annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing personal information. The statute still prints $25 million and points the adjustment at Civil Code §1798.199.95. The CPPA's current figure, effective January 1, 2025, is $26,625,000. The next adjustment is due January 1, 2027.
Three categories, not two
Where GDPR sorts an organization's counterparties into controllers and processors, the CCPA/CPRA sorts them into three categories defined in Civil Code §1798.140, and the category a vendor falls into changes what the business owes consumers about that relationship:
| Category | Definition |
|---|---|
| Service provider - §1798.140(ag) | A person that processes personal information on a business's behalf, under a written contract, and is prohibited by that contract from selling or sharing the information, from using it outside the specified business purposes, and from using it outside the direct business relationship. The contract may also permit the business to monitor compliance, including assessments, audits, or other testing at least once every 12 months. |
| Contractor - §1798.140(j) | A person to whom a business makes a consumer's personal information available for a business purpose, under a written contract with substantially the same restrictions as a service provider's, plus a certification that the contractor understands those restrictions and will comply. The CPRA added this category for recipients who receive data made available to them rather than processing it strictly on the business's instructions. |
| Third party - §1798.140(ai) | Anyone who is not the business the consumer is interacting with, not a service provider to that business, and not a contractor. It is defined by exclusion, and it is the category a business is disclosing to whenever it is not relying on a qualifying service-provider or contractor contract. |
The distinction decides whether a disclosure is a regulated sale or share. The "sell" and "share" definitions in §1798.140(ad) and (ah) are both written as a disclosure to a third party: for monetary or other valuable consideration in the case of a sale, or for cross-context behavioral advertising in the case of a share. Because service providers and contractors are defined out of "third party" by §1798.140(ai), a disclosure to one of them under a qualifying written contract is not a sale or a share, and it does not trigger the consumer's right to opt out of either. Get the contract wrong, or skip it, and the recipient is a third party, so the same disclosure can be treated as a regulated sale.
What the contract must say
Civil Code §1798.100(d) sets the statutory floor for a contract that discloses personal information to a service provider, contractor, or third party. The contract must specify that the information is sold or disclosed only for limited and specified purposes. It must obligate the recipient to comply with the CCPA and to provide the same level of privacy protection the statute requires. It must grant the business the right to take reasonable and appropriate steps to help ensure the recipient uses the information consistently with the business's obligations. It must require the recipient to notify the business if the recipient determines it can no longer meet its obligations. And it must grant the business the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use.
The CPPA's regulations go further for service providers and contractors. The text effective January 1, 2026 is the Agency's own compilation, 11 CCR §7051. In that text the contract shall:
- Prohibit selling or sharing the personal information collected under the contract (§7051(a)(1)).
- Identify the specific business purposes, and state that the business is disclosing the information only for those purposes. Generic descriptions, such as "as set out in this contract," are not enough (§7051(a)(2)).
- Prohibit retaining, using, or disclosing the information for any purpose other than the business purposes in the contract, unless the CCPA or the regulations permit it (§7051(a)(3)).
- Prohibit use outside the direct business relationship, unless the CCPA or the regulations expressly permit it. The regulation's own example is combining the information with personal information received from another source or collected from the recipient's own interaction with the consumer (§7051(a)(4)).
- Require CCPA compliance and the same level of privacy protection required of businesses (§7051(a)(5)).
- Grant the business the right to take reasonable and appropriate steps to ensure compliant use. The regulation says those steps may include ongoing manual reviews, automated scans, and regular assessments, audits, or other technical and operational testing at least once every 12 months (§7051(a)(6)).
- Require notice to the business once the recipient determines it can no longer meet its obligations (§7051(a)(7)), and grant the business the right, upon notice, to stop and remediate unauthorized use (§7051(a)(8)).
- Require the recipient to enable the business to comply with consumer requests, or require the business to pass those requests through with the information needed to comply (§7051(a)(9)).
Two points that show up in a lot of contract checklists are not §7051 terms. There is no §7051 requirement to delete or return personal information when the contract ends. The example under (a)(8) is narrower: the business may require documentation that the recipient no longer retains or uses the personal information of consumers who made a valid deletion request. Separately, notice that a subcontractor has been engaged is a statutory duty, not a §7051 clause. Civil Code §1798.140(ag)(2) (service providers) and §1798.140(j)(2) (contractors) each say that if the recipient engages another person to help process the information for the business purpose, it shall notify the business of that engagement, and the engagement shall be under a written contract binding that person to the paragraph (1) restrictions. The regulation's own subcontract rule is the flow-down in §7051(b): a service provider or contractor that subcontracts shall have a contract with the subcontractor that complies with the CCPA and the regulations, including subsection (a).
Older mirrors of §7051, including some legal-information sites, still number the 12-month monitoring language as (a)(7). That numbering matches the pre-2026 text, which had an extra commercial-purpose prohibition and therefore one more paragraph. In the regulations effective January 1, 2026, the 12-month check is (a)(6), and (a)(7) is the "can no longer meet its obligations" notice. Cite the CPPA compilation, not a stale mirror, when a contract or an audit memo names a subsection.
§7051(c) is the due-diligence hook. Whether a business conducts due diligence of its service providers and contractors factors into whether the business has reason to believe the recipient is using personal information in violation of the CCPA. The regulation's example is direct: a business that never enforces the contract and never exercises its rights to audit or test the recipient's systems might not be able to rely on the defense that it had no reason to believe, at the time of disclosure, that the recipient intended to violate the law.
Two public enforcement actions
The California Attorney General and the CPPA have each announced settlements in which a disclosure of personal information to outside companies was part of the case. The announcements describe different facts, and a program should read each one for what it actually says.
In February 2024, Attorney General Bonta announced a $375,000 settlement with DoorDash. The press release says the Department of Justice found that DoorDash sold its California customers' personal information without providing notice or an opportunity to opt out, in violation of the CCPA and the California Online Privacy Protection Act. The sale, as the release describes it, occurred in connection with DoorDash's participation in a marketing cooperative, where businesses contribute customer personal information in exchange for the opportunity to advertise their products to each other's customers. The release says DoorDash, in January 2020, traded names, addresses, and transaction histories of California consumers to a marketing cooperative in a single transfer. The settlement terms require DoorDash to comply with the CCPA and CalOPPA rules for businesses that sell personal information, to review contracts with marketing and analytics vendors and its use of technology to evaluate whether it is selling or sharing consumer personal information, and to provide annual reports to the Attorney General on any potential sale or sharing. The release frames the violation as a sale without notice or an opt-out.
In September 2025, the CPPA announced a $1.35 million settlement with Tractor Supply Company, which the announcement calls the largest in the CPPA's history at the time. The decision, as the announcement summarizes it, found that Tractor Supply failed to maintain a privacy policy notifying consumers of their rights, failed to notify California job applicants of their privacy rights, failed to provide an effective opt-out of selling and sharing (including through opt-out preference signals such as Global Privacy Control), and disclosed personal information to other companies without entering into contracts that contain privacy protections. The missing-contract finding is one item on that list, alongside the notice and opt-out findings.
Turning this into TPRM actions
- Classify every recipient as a service provider, a contractor, or a third party before personal information flows, not after. The classification determines which contract must exist and whether consumers need a sale or share opt-out. See vendor tiering.
- Audit vendor contracts against §1798.100(d) and the current §7051, including the specific-purpose language in (a)(2), the 12-month monitoring right in (a)(6), and the subcontractor flow-down in (b). A contract that recites only the five statutory items can still miss the regulation.
- Track subcontractor notice under the statute, and flow-down under the regulation. §1798.140(ag)(2) and (j)(2) require notice to the business when another person is engaged. §7051(b) requires that person's contract to meet subsection (a). Confirm both are documented. See fourth-party risk.
- Treat "we do not sell personal information" as a claim to test. The Attorney General's DoorDash announcement treats participation in a marketing cooperative, contributing customer data in exchange for the chance to advertise to other members' customers, as a sale under the CCPA when consumers were not given notice or an opt-out.
- Use the §7051(a)(6) monitoring right, because §7051(c) treats due diligence as part of the legal position. A signed contract is the basis for the relationship. A business that never audits or tests may have trouble claiming it had no reason to believe the recipient would violate the CCPA. See continuous vendor monitoring.
Where this sits among TPRM platforms
Classifying recipients and holding the Civil Code §1798.100(d) and 11 CCR §7051 clause library, including the §7051(b) subcontractor flow-down, is governance workflow that questionnaire and GRC platforms are built to manage well. What that library does not tell a program is whether a service provider's actual, current environment still matches what the contract assumed - the same gap this cluster covers generally in evidence-based risk scoring, where externally observed security-rating signal fills in what a signed contract cannot. Rescana is Fully Autonomous with human in the loop based on preference, pairing that continuous, evidence-based monitoring with automated evidence collection, so a §7051(a)(6) check looks at current signal rather than a contract filed at onboarding. See also the Shared Assessments SIG.
Frequently asked questions
What is a "service provider" under the CCPA/CPRA?
A service provider is a person that processes personal information on a business's behalf and receives that information for a business purpose under a written contract (Civil Code §1798.140(ag)). The contract must prohibit the service provider from selling or sharing the information, from retaining, using, or disclosing it for any purpose other than the business purposes specified in the contract, from using it outside the direct business relationship, and from combining it with personal information from other sources except as the statute and the CPPA's regulations allow. The contract may permit the business to monitor compliance, including assessments, audits, or other testing at least once every 12 months. Because a service provider is defined out of the CCPA's "third party" category, a disclosure to one under a qualifying contract is not a regulated sale or share.
What is the difference between a service provider, a contractor, and a third party under the CCPA?
A service provider processes personal information on a business's behalf under a written contract that carries the restrictions in §1798.140(ag). A contractor, a category the CPRA added, is a person to whom a business makes personal information available for a business purpose under a similarly restrictive written contract, including a certification that the contractor understands the restrictions and will comply (§1798.140(j)). A third party is anyone who is not the business the consumer is interacting with, a service provider, or a contractor (§1798.140(ai)), defined by exclusion. The category matters because the CCPA's "sell" and "share" definitions apply to disclosures to a third party, so a qualifying service-provider or contractor relationship falls outside both.
What must a CCPA/CPRA contract with a service provider or contractor include?
Civil Code §1798.100(d) requires the contract to limit the disclosure to specified purposes, obligate the recipient to comply with the CCPA and provide an equivalent level of privacy protection, grant the business the right to take reasonable steps to help ensure compliant use, require the recipient to notify the business if it can no longer meet its obligations, and grant the business the right to stop and remediate unauthorized use. The CPPA regulations effective January 1, 2026, at 11 CCR §7051, add the regulatory detail: a ban on selling or sharing, a specific statement of business purpose, a ban on use outside the direct business relationship (the regulation's example is combining the data with other sources except as permitted), CCPA-level privacy protection, a monitoring right that may include assessments or audits at least once every 12 months (§7051(a)(6)), notice when the recipient can no longer comply (§7051(a)(7)), a right to stop and remediate unauthorized use, and support for consumer requests. §7051(b) requires a written flow-down contract with any subcontractor that itself meets subsection (a). §7051(c) treats due diligence, including actually using audit rights, as relevant to whether the business can say it had no reason to believe the recipient would violate the CCPA. Notice that a subcontractor has been engaged is a statutory duty under §1798.140(ag)(2) and (j)(2), not a §7051 term. §7051 does not require the contract to delete or return personal information at the end of the contract.
Does sharing personal information with a service provider count as a "sale" under the CCPA?
Not if the contract qualifies. The CCPA's "sell" and "share" definitions (§1798.140(ad) and (ah)) are both written as a disclosure to a third party, and §1798.140(ai) excludes service providers and contractors from "third party." A disclosure to a genuine service provider or contractor under a written contract that meets §1798.100(d) and §7051 is therefore not a sale or a share, and it does not trigger the consumer's opt-out right. Without that qualifying contract, the recipient is a third party and the same disclosure can be treated as a regulated sale. The California Attorney General's February 2024 settlement with DoorDash ($375,000) treated DoorDash's participation in a marketing cooperative - contributing customer personal information in exchange for the chance to advertise to other members' customers - as a sale, because consumers were not given notice or an opportunity to opt out.