Service provider agreements limit use of PI to contracted purposes
Why it matters
CCPA § 1798.100(d) and § 1798.140(ag) establish that disclosing PI to a "service provider" does not constitute a "sale" — but only when a written contract prohibits the service provider from using the PI for any purpose beyond performing the contracted service. Without that contract, your payment processor, email provider, and error tracker are legally "third parties" receiving PI for commercial purposes, which converts every API call into a data sale. Stripe, SendGrid, Resend, Sentry, and Vercel all offer Data Processing Addendums that satisfy this requirement — but you must accept them explicitly, not assume they apply by default.
Severity rationale
Low because service provider contract failures recharacterize routine PI transfers as sales only when combined with other CCPA triggers, but they eliminate the service-provider safe harbor for all downstream PI flows.
Remediation
Accept Data Processing Addendums (DPAs) with every vendor that receives personal information. Most are available in each vendor's admin dashboard or legal portal.
CCPA Service Provider Agreement Checklist
Required contractual provisions (CCPA § 1798.100(d)):
- Prohibit retaining/using/disclosing PI beyond the contracted purpose
- Certify understanding of restrictions
Vendors with CCPA-compliant DPAs:
□ Stripe — stripe.com/legal/dpa (Dashboard > Settings > Legal)
□ SendGrid — sendgrid.com/policies/dpa
□ Resend — resend.com/legal/dpa
□ Google — Accept in Google Admin Console (covers GA4 + Google Ads)
□ Sentry — sentry.io/legal/dpa
□ Vercel — vercel.com/legal/dpa
□ Supabase — supabase.com/privacy
After accepting DPAs, update your privacy policy to classify these vendors as "service providers" or "contractors" — not "third parties" — so consumers understand their PI is not being sold to them.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CCPA/CPRA Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- ccpa · §1798.100(d) — Service provider contracts — written agreement limiting PI use to contracted purpose
- ccpa · §1798.140(ag) — "Service provider" definition — DPA required to qualify as service provider vs. third party
- gdpr · Art. 28 — Processor — data processing agreements required
- iso-27001:2022 · A.5.19 — Information security in supplier relationships
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ccpa-readiness·automated