What is a Service Provider?

"Service Provider" vs. "Third Party"

A “service provider” is a vendor that uses the personal information that a business discloses to it solely to provide (or improve) a service to that business. For example, a service provider is not allowed to build a database of consumer profiles about your business's users or customers, so that it can better serve other businesses. A “third party” is any person or organization that is not a service provider. In theory, a third party may do anything it wants with the personal information a business provides to it. Therefore, when a business provides personal information to third parties, that may be considered a "sale" of personal information.

"Selling" to Third Parties

The CCPA defines a "sale" of personal information broadly to include situations where a business gives third parties access to consumer information and receives anything of value in return, such as money or a service. This rule has some exceptions that our Get Compliant tool will ask about, but in general a business is “selling” information to any vendor that is not a "service provider," and is therefore considered a "third party."

Determining Vendor Classification

Many vendors have statements about their service provider status. Sometimes those statements are in their online terms of service or in their privacy policy. Other times, they may be contained in a data protection addendum (DPA). Usually, these statements are publicly available. But sometimes a business will need to contact the vendor directly to ask whether the vendor is a service provider. For any of your business's vendors that do not have a service provider statement, your business can consider asking the vendor to update its contract language. 

Here is an example of a clear statement of a vendor's status as a service provider to the businesses it serves: