Docs

Appearance

Service providers, third parties, and ADMT suppliers ​

Article 4 of the CCPA regulations (§§ 7050–7053) gives the duties of service providers, contractors, and third parties. It also gives the terms of the contracts that a business makes with them. Article 4 is part of the regulations, and the CCPA statute does not contain it. Civil Code § 1798.140 gives the CCPA terms service provider, contractor, and third party (Service providers, contractors, and third parties).

ADMT supplier is a Modulos CCPA Role value, not a term of the regulations. Section 7153(a) uses "A business that makes ADMT available to another business".

Section 7153 of the CCPA regulations gives one more duty to a business that makes ADMT available to a different business. A service provider or contractor can also be a business (§ 7050(d)).

Dates

  • The 2025 changes to the CCPA regulations apply from January 1, 2026. They changed §§ 7050, 7051, and 7053, and did not change § 7052. Article 4 was part of the regulations before these changes.
  • Section 7222(i) has no compliance date for the duty to help with requests to access ADMT. The business follows the Article 11 dates in § 7200(b).
  • The § 7153 facts are necessary for the recipient-business to conduct, "review", or "update" its assessment as specified in § 7155.

As the business — contracts and the opt-out flow-down ​

The CCPA and Article 4 of the CCPA regulations give a business two contract duties (Civil Code § 1798.100(d), §§ 7051(a) and 7053(a)). The business must make a contract with each service provider or contractor to which it discloses personal information for a business purpose. It must also make an agreement with each third party to which it sells or shares personal information.

The contract with a service provider or contractor. Section 7051(a) of the CCPA regulations tells the business that this contract must contain all of these terms:

  • (1) The contract does not let the service provider or contractor sell or share the personal information "it collects pursuant to the written contract with the business".
  • (2) The contract identifies "the specific business purpose(s) for which the service provider or contractor is processing personal information pursuant to the written contract with the business". It also contains the term that the business discloses the personal information to the service provider or contractor "only for the limited and specified business purpose(s) set forth within the contract". The business purposes "shall not be described in generic terms, such as referencing the entire contract generally", and "The description shall be specific."
  • (3) The contract does not let the service provider or contractor keep, use, or disclose that personal information for a purpose other than the business purposes in the contract, "or as otherwise permitted by the CCPA and these regulations".
  • (4) The contract does not let the service provider or contractor keep, use, or disclose that personal information "outside the direct business relationship between the service provider or contractor and the business, unless expressly permitted by the CCPA or these regulations". Section 7051(a)(4) gives this example: "a service provider or contractor shall be prohibited from combining or updating personal information that it collected pursuant to the written contract with the business with personal information that it received from another source or collected from its own interaction with the consumer, unless expressly permitted by the CCPA or these regulations."
  • (5) The contract contains the term of § 7051(a)(5), below. The two parts of this term are necessary: compliance with the CCPA and the regulations, and the same level of privacy protection.
  • (6) The contract gives the business "the right to take reasonable and appropriate steps to ensure that the service provider or contractor uses the personal information that it collected pursuant to the written contract with the business in a manner consistent with the business’s obligations under the CCPA and these regulations".
  • (7) The contract tells the service provider or contractor "to notify the business after it makes a determination that it can no longer meet its obligations under the CCPA and these regulations".
  • (8) The contract gives the business "the right, upon notice, to take reasonable and appropriate steps to stop and remediate the service provider or contractor’s unauthorized use of personal information".
  • (9) The contract contains one of these two terms:
    • It tells the service provider or contractor "to enable the business to comply with consumer requests made pursuant to the CCPA".
    • It tells the business "to inform the service provider or contractor of any consumer request made pursuant to the CCPA that they must comply with and provide the information necessary for the service provider or contractor to comply with the request".

Section 7051(a)(5) of the CCPA regulations gives the term that the contract must contain:

Require the service provider or contractor to comply with all applicable sections of the CCPA and these regulations, including—with respect to the personal information that it collected pursuant to the written contract with the business—providing the same level of privacy protection as required of businesses by the CCPA and these regulations.

Section 7051(a)(5) then gives examples of terms that "the contract may require". The contract can tell the service provider or contractor to do one or more of these:

  • To "cooperate with the business in responding to and complying with consumers’ requests made pursuant to the CCPA".
  • To help the business with its cybersecurity audit (Article 9), its risk assessment (Article 10), and its ADMT requirements (Article 11).
  • To "implement reasonable security procedures and practices appropriate to the nature of the personal information", "in accordance with Civil Code section 1798.81.5".

For a contractor, Civil Code § 1798.140(j)(1)(B) and (C) make these contract terms necessary:

  • (B) The contract "Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them".
  • (C) The contract "Permits, subject to agreement with the contractor, the business to monitor the contractor’s compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months."

Section 7051(a) does not contain the certification in (B). The contract with a service provider or contractor must also limit "Combining the personal information" that comes from the business with personal information from other sources (Civil Code § 1798.140(ag)(1)(D), (j)(1)(A)(iv)). The CCPA makes this limit necessary and gives exceptions to it.

The agreement with a third party. Section 7053(a) of the CCPA regulations gives the terms of the agreement with a third party. A business that sells or shares personal information with a third party must use an agreement that contains all of these terms:

  • (1) The agreement identifies "the limited and specified purpose(s) for which the personal information is made available to the third party". The purposes "shall not be described in generic terms, such as referencing the entire contract generally", and "The description shall be specific."
  • (2) The agreement contains the term that the business makes the personal information available to the third party "only for the limited and specified purpose(s) set forth within the contract". It tells the third party "to use it only for that limited and specified purpose(s)".
  • (3) The agreement tells the third party to comply with all applicable sections of the CCPA and the regulations, "including—with respect to the personal information that the business makes available to the third party—providing the same level of privacy protection as required of businesses by the CCPA and these regulations".
  • (4) The agreement gives the business the right, for the personal information that the business makes available to the third party, "to take reasonable and appropriate steps to ensure that the third party uses it in a manner consistent with the business’s obligations under the CCPA and these regulations".
  • (5) The agreement gives the business "the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information made available to the third party".
  • (6) The agreement tells the third party "to notify the business after it makes a determination that it can no longer meet its obligations under the CCPA and these regulations".

The opt-out instructions. If a consumer did not opt out "in response to the Pre-use Notice" and requests an ADMT opt-out after the business initiates processing, the business must give the § 7221(n)(2) notice and instructions.

Section 7221(n)(2) gives this duty to the business. The service providers, contractors, and other persons that get the notice also have duties in the CCPA regulations. These duties include:

  • A service provider or contractor must comply with its contract (§ 7050(f)).
  • A third party must comply with its contract (§ 7052(b)).
  • The terms that these contracts must contain include compliance with the CCPA and the regulations (§§ 7051(a)(5) and (9), 7053(a)(3)).

Due diligence and liability. Section 7051(c) of the CCPA regulations gives this rule for service providers and contractors:

Whether a business conducts due diligence of its service providers and contractors factors into whether the business has reason to believe that a service provider or contractor is using personal information in violation of the CCPA and these regulations. For example, a business that never enforces the terms of the contract nor exercises its rights to audit or test the service provider’s or contractor’s systems might not be able to rely on the defense that it did not have reason to believe that the service provider or contractor intends to use the personal information in violation of the CCPA and these regulations at the time the business disclosed the personal information to the service provider or contractor.

Section 7053(b) gives the same rule for third parties. Its example is only a business "that never enforces the terms of the contract", and it does not refer to rights to audit or test.

The CCPA gives a business protection from liability when a service provider, contractor, or third party uses personal information in violation of the CCPA (Civil Code § 1798.145(i)). The protection applies only on these conditions:

  • Service provider or contractor ((i)(1)): the business discloses the personal information "in compliance with this title". At the time of the disclosure, the business "does not have actual knowledge, or reason to believe, that the service provider or contractor intends to commit such a violation".
  • Third party ((i)(2)): the business discloses the personal information to a third party "pursuant to a written contract that requires the third party to provide the same level of protection of the consumer’s rights under this title as provided by the business". At the time of the disclosure, the business "does not have actual knowledge, or reason to believe, that the third party intends to commit such a violation".
  • Consumers with no protection for the business ((i)(2)): the protection in (i)(2) does not apply to the personal information of "consumers who have exercised their right to opt out of the sale or sharing of their personal information, consumers who have limited the use or disclosure of their sensitive personal information, and minor consumers who have not opted in to the collection or sale of their personal information".

A service provider or contractor "shall likewise not be liable under this title for the obligations of a business for which it provides services", but it "shall be liable for its own violations of this title" (Civil Code § 1798.145(i)(1)).

As a service provider or contractor ​

Article 4 of the CCPA regulations and the CCPA give a service provider or contractor these duties for the personal information that it "collected pursuant to the written contract with the business":

ItemDuty of the service provider or contractorProvision
Use of the personal informationIt can keep, use, or disclose the personal information only for the purposes in § 7050(a). For these purposes, the retention, use, or disclosure must be "reasonably necessary and proportionate".§ 7050(a)
Requests that consumers send to itIt must "act on behalf of the business in accordance with the business’s instructions for responding to the request", or it must "inform the consumer that the request cannot be acted upon because the request has been sent to a service provider or contractor".§ 7050(c)
The contractIt must comply with "the terms of the contract required by the CCPA and these regulations".§ 7050(f)
SubcontractorsWhen it engages a different person to help it process personal information for a business purpose for the business, it must notify the business. It must engage that person "pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1)" of Civil Code § 1798.140(ag) or (j). The same applies when a person that it engaged engages one more person for that business purpose.Civil Code § 1798.140(ag)(2) and (j)(2)
Contracts with subcontractorsIt must have a contract with each subcontractor. The contract must comply with the CCPA and the regulations, which include § 7051(a).§ 7051(b)
The risk assessment of the businessIt must "cooperate with the business" for the business’s Article 10 risk assessment. This includes "making available to the business all facts necessary to conduct the risk assessment that are in the service provider’s or contractor’s possession, custody, or control, and not misrepresenting any fact necessary to conduct the risk assessment".§ 7050(h)(2)
Requests to access ADMTIt must give "assistance to the business in responding to a verifiable consumer request to access ADMT".§ 7222(i)

Section 7222(i) of the CCPA regulations gives this duty:

A service provider or contractor must provide assistance to the business in responding to a verifiable consumer request to access ADMT, including by providing the business with the consumer’s personal information it has in its possession that it collected pursuant to their written contract with the business, or by enabling the business to access that personal information.

No contract that complies with § 7051(a). In § 7050(e) of the CCPA regulations, a person "who does not have a contract that complies with section 7051, subsection (a), is not a service provider or a contractor under the CCPA". The section gives an example: the disclosure of personal information to that person "may be considered a sale or sharing of personal information for which the business must provide the consumer with the right to opt-out of sale/sharing".

A service provider or contractor that is a business. Section 7050(d) of the CCPA regulations gives this rule:

A service provider or contractor that is a business shall comply with the CCPA and these regulations with regard to any personal information that it collects, maintains, or sells outside of its role as a service provider or contractor.

For example, Article 11 applies to its use of that personal information with ADMT for a significant decision (§ 7200(a)).

As a third party ​

Section 7052 of the CCPA regulations applies to all personal information that a business made available to a third party. Section 7052(a) gives this rule:

A third party that does not have a contract that complies with section 7053, subsection (a), shall not collect, use, process, retain, sell, or share the personal information that the business made available to it.

A third party that has such a contract must comply with "the terms of the contract required by the CCPA and these regulations". These terms include "treating the personal information that the business made available to it in a manner consistent with the business’s obligations under the CCPA and these regulations" (§ 7052(b)).

As a business that makes ADMT available to other businesses ​

Section 7153(a) of the CCPA regulations applies to "A business that makes ADMT available to another business (“recipient-business”) to make a significant decision as set forth in section 7150, subsection (b)(3)". That business "must provide to the recipient-business all facts available to the business that are necessary" for the risk assessment that the recipient-business conducts.

These points give the limits of the duty:

  • Trained ADMT only. Section 7153(b) applies the duty only to "ADMT trained using personal information". For the term "train" in § 7153, refer to section 7001(fff).
  • The business. The duty applies only to a business as specified in Civil Code § 1798.140(d) (The business and the consumer).
  • Personal information. Section 7153 does not make it a condition that the business gives personal information to the recipient-business.
  • One direction. Section 7153 gives no duty to the recipient-business. The recipient-business uses the facts for its risk assessment in § 7152.

When the recipient-business uses ADMT for a significant decision, its risk assessment must identify "The logic of the ADMT, including any assumptions or limitations of the logic" and "The output of the ADMT, and how the business will use the output to make a significant decision" (§ 7152(a)(3)(G)). Contents of the risk assessment gives all the contents.

The business that makes ADMT available must also comply with Article 11 when it uses ADMT for a significant decision (§ 7200(a)).

Service providers and third parties in Modulos ​

The CCPA regulations give businesses, service providers, contractors, and third parties contract and ADMT duties. In Modulos, the Requirements for these duties are MRF-496 in MFF-29 (AI System level) and ORF-491 in OFF-29 (Organization level). Purpose limits on personal information gives the § 7002 limits on the processing of personal information by a business.

Where to go next ​

Disclaimer

This page gives general information. It is not legal advice.