So I'm A Third Party, Not A Service Provider. Now What?

Companies throughout the ad tech ecosystem are reckoning with the fact that, due to the revised definition of "business purpose" in the California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), they may no longer qualify as "service providers" under California privacy law. Instead, they might be treated as "third parties" – and possibly even as "businesses." As a result, their compliance obligations are likely to be more challenging.

The CPRA provides that, while businesses can still disclose personal information to "service providers" for "business purposes," those "business purposes" do not include "cross-context behavioral advertising." Any disclosure for such advertising activities will disqualify any recipient of that information from being considered a "service provider."