CCPA service provider vs contractor vs third party in data licensing

Verdict: which CCPA role does each party in a licensing project play?

The role follows the contract and the actual data flow, not the label a party uses for itself. In a typical licensing project, a vendor that de-identifies the company's records on its instructions is the clearest candidate for service provider or contractor status. A buyer that receives the data for its own purposes is the clearest candidate for a third party. A transaction platform may fall in either place depending on what it does with the data.

This matters only if the records contain California personal information and the company is a covered business. The CCPA applicability thresholds come first. Everything below is a framework for the company's counsel, who decides the real roles.

Side-by-side: service provider, contractor and third party

The statute behind the table is the California Consumer Privacy Act, Civil Code section 1798.100 and following. Section 1798.100 requires that a business that sells or shares personal information, or discloses it to a service provider or contractor, have a written agreement limiting use to specified purposes. Section 1798.140 holds the definitions, including "sell" and "share". The California Privacy Protection Agency regulations page lists the regulations that add detail on contract content.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

When does the service provider role fit a de-identification vendor?

A de-identification vendor looks like a service provider when four things hold.

1. It processes records only on the company's documented instructions.
2. It has no right to keep, combine or reuse the data for its own products.
3. Its contract states the permitted purposes and prohibits other use.
4. The company can audit or verify what it does, and gets the data back or deleted at the end.

If the vendor also wants to retain derivatives, train its own models on the raw text, or sell insights, the role starts to look like a third party, and the company should hear that before signing.

When is the transaction platform a service provider and when is it not?

A platform that only arranges the sale, prepares an inventory and delivers data on the company's instructions is closer to a service provider. A platform that takes its own rights in the personal information, for example to enrich it or resell it elsewhere, is closer to a third party. The honest answer for any specific arrangement is to read the agreement. Companies should ask for a clear statement of what the platform does with records it touches, and whether it ever sees personal information before de-identification.

SourceX manages the licensing process between companies and AI data buyers, and de-identification and redaction requirements are agreed with the company before any work begins. Data is delivered only after an executed agreement and the company's authorization.

Contract checklist for company counsel

• Each party's role is written down, and matches what it actually does.
• Service provider and contractor agreements limit use to specified business purposes.
• The vendor cannot sell or share the personal information it receives.
• The agreement lets the company stop or remediate unauthorized use.
• Flow-down terms apply to any sub-processor.
• The licensee's agreement covers de-identification commitments and a ban on re-identification, see the CCPA deidentified data page.
• Records of EU personal data are handled separately, for example under the CCPA versus GDPR employee data comparison.

Common mistakes

What does this mean for a referral partner?

You do not decide roles or draft contracts. You can tell an owner that the roles of each party are mapped at the contract stage, with the company's counsel, and that a buyer expecting de-identified data is a different relationship from a vendor working on the company's instructions. Buyers also care about legal exposure from how data was obtained, which is the theme of the FTC algorithmic disgorgement guide, and the first-party data explainer shows why records a company created itself are easier to clear.

The partner earns 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee.

Next step

Use the company fit checker for a preliminary screen, read how it works, and register as a partner to introduce a US company with 50+ full-time employees at peak (contractors excluded).