---
title: "California privacy law (CCPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/california/processors"
source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)

# California privacy law (CCPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

California calls processors 'service providers' and 'contractors'. A business that discloses personal information to a service provider or contractor, or sells or shares it with a third party, must have a written agreement limiting use to specified purposes, requiring CCPA-level protection and allowing the business to stop unauthorized use. Without a compliant contract, the recipient is not a service provider or contractor and the disclosure may be a sale or sharing.

## Key points

1. Agreement must limit the purposes for which the information is sold or disclosed.

   Section: [Cal. Civ. Code § 1798.100(d)(1)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

2. Recipient must comply with the CCPA and give the same level of privacy protection.

   Section: [Cal. Civ. Code § 1798.100(d)(2)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

3. Business must have rights to take reasonable steps to ensure proper use, and to stop and remediate unauthorized use.

   Section: [Cal. Civ. Code § 1798.100(d)(3), (5)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

4. Recipient must notify the business if it can no longer meet its obligations.

   Section: [Cal. Civ. Code § 1798.100(d)(4)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

5. Service providers act under a written contract that bars selling, sharing, or using the data outside the business relationship.

   Section: [Cal. Civ. Code § 1798.140(ag)(1)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

6. Detailed contract terms for service providers, contractors and third parties are in the regulations.

   Section: [Cal. Code Regs. tit. 11, §§ 7051, 7053](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

## Sources

- [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf)
- [CPPA, Law and regulations index](https://cppa.ca.gov/regulations/)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.)

Reference material, not legal advice.

## Other topics for California

- [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents