California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)
California privacy law (CCPA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
California calls processors 'service providers' and 'contractors'. A business that discloses personal information to a service provider or contractor, or sells or shares it with a third party, must have a written agreement limiting use to specified purposes, requiring CCPA-level protection and allowing the business to stop unauthorized use. Without a compliant contract, the recipient is not a service provider or contractor and the disclosure may be a sale or sharing.
Key points
Agreement must limit the purposes for which the information is sold or disclosed.
Section: Cal. Civ. Code § 1798.100(d)(1)
Recipient must comply with the CCPA and give the same level of privacy protection.
Section: Cal. Civ. Code § 1798.100(d)(2)
Business must have rights to take reasonable steps to ensure proper use, and to stop and remediate unauthorized use.
Section: Cal. Civ. Code § 1798.100(d)(3), (5)
Recipient must notify the business if it can no longer meet its obligations.
Section: Cal. Civ. Code § 1798.100(d)(4)
Service providers act under a written contract that bars selling, sharing, or using the data outside the business relationship.
Section: Cal. Civ. Code § 1798.140(ag)(1)
Detailed contract terms for service providers, contractors and third parties are in the regulations.
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the California statute
Reference material, not legal advice.