Contractor (CPRA Definition)

Under CPRA, a person to whom a business makes available a consumer's personal information for a business purpose pursuant to a written contract, provided certain conditions are met. Contractors occupy a middle ground between service providers (who process data strictly on the business's behalf) and third parties (who receive data for their own purposes). A contractor can use personal information for limited specified purposes beyond just processing on the business's behalf, but is still bound by contractual restrictions. The contractor category recognizes business relationships where some shared use of data occurs—like joint marketing ventures, co-branded services, or strategic partnerships. To qualify as a contractor, the relationship must be governed by a written contract restricting use, preventing sale or sharing for other purposes, and ensuring compliance with the consumer's opt-out rights. This category provides flexibility for certain business partnerships while maintaining privacy protections.