Reply to thread

Hello Brad,  that's a really common question we get (the other one is how do you verify someone's identity before complying with their request)

The CCPA page lists definitions including how they define a third party here, under (w):

[URL unfurl="true"]http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140[/URL].

If your vendor has a written contract and:

• Is not selling the consumer's information
• The contract protects the consumer's information, which includes a statement saying they won't sell the consumer's information.
• The contract only allows the vendor to do what you contracted them to do with the consumer's information and nothing else.

Then you should be ok.

This is usually one of the biggest problems dealerships we've been working with run into.  They either don't have contracts or the contracts with their vendors don't have the written stipulations to protect the consumer's data so they are having to go back and work out new contracts. 

Note: this is not legal advise and I am not an attorney.  You should consult an attorney for a legal opinion.

-Carl