In order to be considered a service provider under the CCPA, a legal entity must process personal information “on behalf of a business”[1] and be prohibited by contract from:

1. Retaining the personal information “for any purpose other than for the specific purpose of performing the services specified in the contract . . . or as otherwise permitted by this title,”[2]
2. Using the personal information “for any purpose other than for the specific purpose of performing the services specified in the contract . . . or as otherwise permitted by this title,”[3] or
3. Disclosing the personal information “for any purpose other than for the specific purpose of performing the services specified in the contract . . . or as otherwise permitted by this title.”[4]

As a result, whether a particular analytics cookie provider is considered a “service provider” depends upon whether the contract in place between a website operator and the analytics provider contains the above-referenced terms.

The CPRA amended the CCPA’s definition such that, beginning Jan. 1, 2023, the written contract between a website operator and an analytics cookie provider would also need to contain the following additional prohibitions in order for the analytics provider to be considered a service provider:

4. Prohibition against selling or sharing personal information,[5]
5. Prohibition against retaining, using, or disclosing personal information “outside of the direct business relationship” between the service provider and the business,[6] and
6. Prohibition against combining (subject to some exceptions) the personal information that the service provider receives from one business with information that it receives from another business.[7]

[1] Cal. Civ. Code 1798.140(v) (Oct. 2020).

[2] Cal. Civ. Code 1798.140(v) (Oct. 2020).

[3] Cal. Civ. Code 1798.140(v) (Oct. 2020).

[4] Cal. Civ. Code 1798.140(v).

[5] Cal. Civ. Code 1798.140(ag)(1)(A).

[6] Cal. Civ. Code 1798.140(ag)(1)(C).

[7] Cal. Civ. Code 1798.140(ag)(1)(D).