Skip to content

What Is A Service Provider Under The CCPA?

Paige Harris Mar 19, 2022 8:00:00 AM

In 2018, California created a statute to regulate how companies and organizations collect and use personal information about their customers. The California Consumer Privacy Act (CCPA) gives consumers more control over their data. CCPA allows consumers to see what personal data a company collects and how they intend to use it. But who must comply with the CCPA? And does the CCPA apply to employees?

The CCPA compliance checklist isn’t very complex because the act mainly applies to businesses that sell goods or services to residents of California.


What Is A Service Provider?

According to the CCPA, a service provider is any legal entity specializing in providing services. To qualify as a service provider under CCPA, it must also fulfill the following requirements:

  • Operate for profit
  • Receive personal data about consumers from a business
  • Process the personal data on behalf of the business

An excellent example of a service provider is an email marketing company or an analytics provider. Payment processing and customer relationship management companies are other examples of service providers.


What Does A Service Provider Do Under The CCPA?

Again, a service provider is a legal entity offering services on behalf of your business. Often, they use personal data about your consumers to do so. The CCPA distinguishes a service provider from other entities, such as a third party and a business. 

The main benefit of working with a service provider instead of a third party is that sharing personal data about consumers with a service provider isn’t considered selling the information if you follow the correct procedure.

Unfortunately, this privacy act places numerous demands on businesses that sell personal information about consumers. For instance, it requires such companies to put a “Don’t Sell My Personal Information” button on their websites, preferably on the homepage, to allow customers to inform them if they don’t want their information sold. But if you choose to work with a third party, the CCPA might decide that you are selling personal information about your consumers, even if you share the data for reasons other than monetary gain.

Another essential requirement is that any business that sells personal information must allow its customers to opt-out at any time from receiving personalized advertisements served through third-party JavaScript. 

These CCPA requirements do not apply to your business if you share personal information about your customers with a service provider because this activity doesn’t count as selling. But you are still required to inform your consumers of the type of personal data you collect and share with the service provider and for what purpose.

Does CCPA apply to employees? Some of your employees might also be your customers. In any case, the CCPA defines a consumer as anyone residing in California. Therefore, if your employee lives in California, they automatically qualify as consumers.

In January 2020, California amended the CCPA to include section 1798.145(h)(3), which requires businesses to provide their employees with notice, before or during the collection of their data, informing them of their intention to use the information and for what purpose. Therefore, your business shouldn’t collect other categories of information about employees apart from those indicated in the notice. And if you share any information about your employees with your service provider that is not in the statement, you are violating the privacy policy.

In short, a service provider under CCPA is any legally registered company that offers services on behalf of your business and uses the personal information you provided it with the intention of making a profit.

CTA CCPA Compliance Graphic


Leave a Comment