Under the CCPA, what makes an advertising or analytics vendor a service provider rather than a third party, and why can't cross-context advertising qualify?

## Why the label matters Under the CCPA as amended by the CPRA, both 'sale' and 'sharing' require a disclosure to a **third party**. Civil Code `1798.140(ai)` defines a third party as anyone who is **not** the business the consumer intentionally interacts with, a **service provider** or a **contractor**. So a vendor that qualifies as a service provider sits outside both definitions, and the business owes no opt-out for that flow. 11 CCR 7026(f)(1) confirms that collection by a service provider or contractor under a compliant contract is not a sale or sharing. ## The statutory definition `1798.140(ag)(1)`: a service provider is a person that **processes personal information on behalf of a business** and receives it **for a business purpose** under a **written contract** that prohibits it from: 1. **Selling or sharing** the personal information; 2. Retaining, using or disclosing it for any purpose **other than the business purposes specified** in the contract, including any other commercial purpose; 3. Retaining, using or disclosing it **outside the direct business relationship** with the business; 4. **Combining** it with personal information from other sources or its own interactions, except for business purposes the regulations permit. The contract may let the business monitor compliance, including assessments or audits at least once every 12 months. Sub-processors must be notified to the business and bound by the same terms (`1798.140(ag)(2)`). A **contractor** (`1798.140(j)`) has near-identical conditions and must also **certify** that it understands and will comply with them. ## The contract the regulations require 11 CCR 7051(a) lists the terms. Among them: - prohibit selling or sharing; - identify the **specific** business purposes; a generic reference to 'the services under this agreement' is not enough; - prohibit use for other purposes, other commercial purposes, or outside the direct relationship, including combining the data with other sources; - require compliance with the CCPA and the same level of privacy protection; - grant the business rights to ensure proper use and to stop and remediate unauthorised use; - require the vendor to notify the business if it can no longer meet its obligations, and to help it comply with consumer requests. Under 7050(e), a person **without** a contract that complies with 7051(a) **is not a service provider or contractor**, and a disclosure to it may be a sale or sharing that needs the opt-out. ## Where advertising falls | Vendor activity for the business | Service provider possible? | Source | |---|---|---| | Measuring the site's own audience, for the site only | Yes, with a compliant contract | `1798.140(e)(5)` | | Contextual ads, such as ads on recipe pages for cookware | Yes | 7050(b) example | | Nonpersonalised ads from aggregated or demographic segments | Yes | 7050(b) example | | Matching the business's customer emails to target those users on the vendor's platform | No: cross-context behavioural advertising | 7050(b) example | | Retargeting the site's visitors across other sites and apps | No: third party for that service | 7050(b), `1798.140(e)(6)` | `1798.140(e)(6)` makes 'advertising and marketing services, except for cross-context behavioural advertising' a business purpose, and bars service providers from combining opted-out consumers' data with other data for advertising. 11 CCR 7050(b) closes the loop: **a person who contracts to provide cross-context behavioural advertising is a third party**, not a service provider, with respect to that service. ## What a service provider may still do 11 CCR 7050(a) lets a service provider use the data for the contracted purposes, for sub-processors that meet the same requirements, to **build or improve the quality of its own services** as long as it does not use the data to perform services for another person, and to detect security incidents and fraud. The regulation's examples draw the line: an email vendor may learn from engagement to improve its product for everyone, but may not use one client's list to send another client's emails. ## Due diligence 11 CCR 7051(c) makes enforcement part of the defence. A business that never exercises its audit rights or enforces the contract may be unable to claim it had no reason to believe the vendor was misusing the data. ## Interview answer in one line A vendor is a service provider when a compliant written contract confines it to specified business purposes, and it stays one only while it keeps to them; cross-context behavioural advertising can never be one of those purposes.