Service Providers and Contractors

What it requires

A service provider or contractor may retain, use, or disclose personal information only for the purposes the section allows, chiefly the business purposes in its written contract. Subsection (b) draws the line that matters for ad tech: a service provider cannot contract to provide cross-context behavioral advertising, and a company that does so is a third party, not a service provider, for that service. Subsection (e) adds that a recipient without a contract complying with § 7051(a) is not a service provider at all, so disclosing personal information to it may be a sale or sharing the consumer can opt out of.

Regulation text

(b) A service provider or contractor cannot contract with a business to provide cross-context behavioral advertising. Pursuant to Civil Code section 1798.140, subdivision (e)(6), a service provider or contractor may contract with a business to provide advertising and marketing services, but the service provider or contractor shall not combine the personal information of consumers who have opted-out of the sale/sharing that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or collects from its own interaction with consumers. A person who contracts with a business to provide cross-context behavioral advertising is a third party and not a service provider or contractor with respect to cross-context behavioral advertising services. [...] (e) A person who does not have a contract that complies with section 7051, subsection (a), is not a service provider or a contractor under the CCPA.

California Consumer Privacy Act / California Privacy Rights Act, § 7050Read the full section from California Privacy Protection Agency (CalPrivacy)