CCPA Service Provider

What is a CCPA service provider?

The CCPA sorts the companies you send personal information to into roles. The statute defines a service provider as "a person that processes personal information on behalf of a business" under a written contract. Your payment processor, help desk tool and email platform can all be service providers.

The role matters because of what it is not. Data you give a service provider under a proper contract is not a sale or sharing. The CCPA regulations say so directly for data collected under the required written contract. Without that contract, the same transfer could count as a sale and bring opt-out duties.

There are two other roles:

• Contractor: a company you make personal information available to for a business purpose, also under a written contract with limits on how it may use the data.
• Third party: anyone who is not you, your service provider or your contractor. One example is an ad network that uses visitor data for its own targeting. Giving data to a third party can be a sale or sharing.

What it looks like in a vendor's terms

A typical clause reads like this:

Vendor is a service provider under the CCPA. Vendor will not sell or share Personal Information, will use it only to provide the Services described in this Agreement, will not retain or use it outside the direct business relationship with Customer, and will not combine it with information from other sources except as permitted by law. Vendor will tell Customer if it can no longer meet these obligations.

Each part comes from the statute:

• Will not sell or share: the core promise that keeps the vendor out of the third-party role.
• Only to provide the Services: the contract must list the business purposes, and the vendor cannot go beyond them.
• Direct business relationship: the vendor cannot use your data to serve other customers or build its own products.
• Not combine: the vendor cannot merge your data with data from elsewhere, apart from narrow exceptions in the regulations.
• Tell Customer: the vendor must notify you if it can no longer comply, and you need the right to stop and fix any unauthorized use.

Stripe's DPA is one real example: in section 3.3, Stripe commits to "not sell or share" personal data when it acts as a processor.

A real change we caught

Venpo flagged that HubSpot now collects your email engagement data for its commercial dataset. When a vendor uses customer data for its own products, ask how that fits the limits of the service provider role for that data.

Why it matters to you

You can create a sale without meaning to. If a vendor's contract lacks the service provider terms, or its privacy policy reserves the right to use your data for its own purposes, the flow may count as a sale or sharing on your side. See selling vs sharing.

Privacy requests go through you. The Attorney General notes that a service provider may deny a request sent to it directly, so people must come to you. You then rely on the vendor: the regulations require service providers to help with deletion requests and requests to know.

New duties are flowing down. Under the CCPA rules effective January 1, 2026, service providers must cooperate with your risk assessments and cybersecurity audits. Older contracts may not say so.

What to check

• The vendor's DPA or terms name it as a CCPA service provider or contractor, not just a GDPR data processor.
• The contract lists specific business purposes, not "any lawful purpose."
• It includes all four prohibitions: no selling or sharing, no other purposes, no use outside your relationship, no combining.
• The vendor will help with deletion, access and correction requests.
• The vendor will cooperate with risk assessments and audits.
• The privacy policy does not contradict the DPA, for example by claiming rights to use customer data for its own AI or analytics.

How Venpo helps

Venpo watches your vendors' DPAs, privacy policies and terms and emails you a plain-English alert when service provider language, data use rights or sale and sharing terms change. The Fine Print Scan answers, for each vendor, whether it sells data or uses it for ads and whether it trains AI on your data.