Third-Party Data Provider Compliance Posture for GDPR and CCPA

Many businesses operate on the assumption that a signed vendor agreement transfers risk along with the data: hand a provider a contract clause about privacy, and the exposure belongs to the provider from that point forward. Neither GDPR nor CCPA supports that assumption. Under both regimes, if a business engages a third-party data provider, it still bears legal responsibility for what happens to that data after it leaves the building. GDPR draws this through the controller-processor relationship: any vendor processing personal data on a business's behalf is a data processor, and the controller must enter into a Data Processing Agreement that satisfies Article 28's specific requirements, not a generic confidentiality clause. Article 5(2) sharpens the obligation further: the controller has to demonstrate compliance rather than merely assert it, and if it can't produce that proof, that failure is itself fineable under Article 83(4). CCPA imposes a parallel structure: every vendor touching a consumer's personal information needs a written contract that restricts use to the contracted business purpose, and without that contract, the vendor is legally a "third party," which can trigger the statute's "sale" or "sharing" definitions regardless of what the business intended. Every pixel, SDK, and data feed a business deploys counts as a disclosure to another company, and each one needs a compliant contract behind it or it risks constituting a sale under the statute's terms. California's 2025 enforcement record confirms none of this is theoretical: the state announced millions of dollars in enforcement actions tied to vendor contracts missing required terms, opt-out mechanisms that didn't function, and privacy policies that were absent or deficient.

The structural gap behind the ordinary oversight

These penalties rarely happen because businesses don't know the rule. Todd Snyder's enforcement action illustrates how severe that blind spot can get: a cookie banner on the company's site disappeared for 40 days, and the business did not detect the outage until regulators did. A review of data protection assessments across thousands of vendors found that nearly two in three software vendors advertising AI features had not disclosed that another AI provider processes data for them. The register of authorized processors drifts out of date, change notices arrive after processing has already begun, objection windows get enforced inconsistently, and no record survives of who was told what.

Ad-tech stacks concentrate this risk particularly sharply. The Tractor Supply settlement captures how far regulators now expect that governance to reach: the company had to confirm in writing to the Enforcement Division that compliant contractual terms were in place "with all external recipients of personal information," a phrase whose breadth signals the full perimeter regulators intend to police. If a business already carries a DPA clause in its vendor contracts, it tends to believe the risk has been handled contractually. CCPA enforcement has made clear that belief is incomplete: a business that never enforces its contract terms and never exercises its audit rights may not be able to claim it had no reason to believe the vendor would misuse the data. A clause on paper is necessary, but it does nothing on its own to close the gap between what the contract promises and what the vendor actually does.

The shift from warning letters to fines that punish the gap directly

Regulators on both sides of the Atlantic no longer just flag vendor oversight failures and ask for a fix. They now fine the failure to prove that oversight exists, turning the structural gap itself into the target of enforcement. California's 2025 enforcement wave set a record, and you can line the cases up by failure mode, not by company size. Honda paid $632,500 in March 2025 for a dark-pattern consent tool that made opting out harder than opting in, for demanding excessive personal information before honoring privacy requests, for failing to provide a usable method for authorized agents, and for sharing data with ad-tech vendors without CCPA-compliant contracts in place. Todd Snyder paid $345,178 in May 2025, and regulators treated its 40-day cookie banner outage as proof of inadequate compliance monitoring: they held the business responsible for its own vendor's platform misconfiguration rather than excusing the gap because a third party caused it. Healthline Media paid $1.55 million in July 2025: its privacy policy had much of the required language on paper, but its opt-out controls simply did not work, and its advertising partner contracts let partners use consumer data broadly in-house; the settlement required annual audits and new, compliant agreements going forward. Tractor Supply paid $1.35 million in September 2025 for sharing personal information with ad-tech companies under data processing agreements that didn't sufficiently limit use to specified purposes, compounded by inadequate privacy disclosures and a failure to honor Global Privacy Control signals.

GDPR enforcement in 2026 shows data protection authorities applying the same logic under regulatory guidelines: they treat weak processor management, missing DPIAs, and thin technical controls as aggravating factors that increase fine amounts, not as separate violations to address later. TikTok was fined €530 million for illegal data transfers. Regulators are increasingly using website scanning technology to police these obligations, which removes the assumption that only the largest, most visible companies face this kind of exposure. The Allstate/Arity case, filed by the Texas Attorney General in January 2025, shows how far liability can travel through a data supply chain a business never fully mapped: the state's first enforcement action under its comprehensive privacy law targeted Allstate and its subsidiary Arity for paying app developers, including GasBuddy, Fuel Rewards, and Routely, to embed tracking SDKs that collected precise geolocation data without consumer notice, data Allstate then sold to insurance companies.

Contract requirements for compliant vendor agreements under each regime

If a contract clause falls short of each regime's specific statutory language, it does not work as a compliance defense. It functions as evidence of the exact gap regulators are now fining. Under GDPR Article 28, a Data Processing Agreement has to specify the subject matter, duration, nature and purpose of processing, the type of personal data involved, the categories of data subjects, and the obligations and rights of the controller. It must also require the processor to act only on documented controller instructions, bind all authorized personnel to confidentiality, implement appropriate technical and organizational measures, set conditions for engaging sub-processors, commit to assisting with data subject rights and security incident response, provide for deletion or return of data at the end of the relationship, and supply the controller with everything needed to demonstrate compliance and support an audit. EDPB Opinion 22/2024 adds a further obligation: the controller must have the identity of every processor and sub-processor in the chain readily available at all times, with the processor responsible for keeping that information current.

CCPA's requirements for service-provider and contractor contracts run along a different but equally specific list. The contract must limit disclosure to specified purposes, prohibit the service provider from selling or sharing the personal information, prohibit retaining, using, or disclosing it outside the agreement's stated business purpose, and prohibit combining it with data from other sources or other interactions. It must give the business the right to take reasonable steps to confirm the vendor is using the data consistent with these obligations, require the vendor to notify the business if it can no longer meet them, and give the business the right to take reasonable steps to stop and remediate any unauthorized use. Honda's enforcement action shows what happens at the far end of noncompliance: the company could not produce any contracts at all with its advertising technology vendors, and the complete absence of CCPA-required written agreements was cited directly as a violation. Beginning January 1, 2027, the obligations only widen: the right to delete will extend to personal information a business obtained from third parties. Bought lists and data enrichment feeds now need a deletion path built directly into the vendor contract, not added after the fact.

Building a vetting and due-diligence posture before a contract is signed

Because a compliant contract can only be written for a vendor whose data practices are already understood, vetting is the precondition for good contracting. CCPA compliance work has to start with a data inventory: a list of every category of personal information collected, where it came from, what business purpose it serves, and every third party it reaches, including the cookies and trackers that accumulate quietly as marketing tags and analytics scripts get added over time. GDPR's records of processing activities under Article 30 serve a related but narrower function: they record categories of recipients, including processors, but don't expressly require a map of every sub-processor beneath them; still, the inventory works as both a compliance document and a risk-management tool regardless of which statute drives it.

With the inventory in place, a vendor intake questionnaire does the next layer of work: what personal data the vendor collects or receives, for what purposes, who its sub-processors are, where data is stored and transferred, what security certifications it holds, and how it handles deletion requests. If a vendor has added AI features since its last disclosure, you need to ask which AI provider processes data for those features, and whether that addition counts as a new sub-processor that needs authorization. New obligations effective January 1, 2026, formalize much of this sequence: CCPA now requires data protection impact assessments for any processing activity presenting significant risk to consumer privacy or security, including processing sensitive personal information, selling data, or using automated decision-making. The DPIA then becomes the business's own evidence of compliance if the CPPA comes asking.

Monitoring vendor behavior after the contract is signed

Signing a compliant contract does not transfer the ongoing compliance burden to the vendor. CCPA Section 7051(c) reinforces the same point from the enforcement side: a business that never enforces its contract terms and never exercises its audit or testing rights may not be able to rely on the defense that it had no reason to believe the vendor intended to misuse the data. Todd Snyder's enforcement action turned this into settled practice: the contracting business bore responsibility when the vendor's consent technology failed, making technical monitoring of vendor-operated tools a legal obligation.

The sub-processor change-notice system is where this obligation most often fails in practice, and almost never because a clause is missing. Technical verification of data flows deserves the same discipline. Healthline Media's $1.55 million settlement traces directly to opt-out controls that were described correctly in the privacy disclosure but did not function on the site itself, where 118 cookies and 82 pixels kept firing data to third parties regardless of what a consumer selected. A straightforward test catches this kind of failure: opt out, clear cookies, revisit the site, and check whether a tracking pixel fires or an ad network request still succeeds. You need the same technical verification for Global Privacy Control signal recognition rather than an assumption that it works, because eleven states, California among them, now require businesses to treat the GPC signal as a valid opt-out. Audit rights only matter if they get used. If a DPA clause substitutes a certification reference for a genuine audit right, it does not satisfy Article 28(3)(h), though a certification can serve as supporting evidence alongside the controller's own audit. California regulators said in September 2025 that they are pursuing hundreds of open investigations with an aggressive focus on service-provider contracts, GPC signals, and data broker registration. This removes any expectation that monitoring failures will only surface after a consumer complaint.

Building an auditable record that proves the posture to regulators

Every step of the vetting and monitoring posture described above only has compliance value if it produces a written record, because under both GDPR and CCPA, the burden of proof sits with the controller, not with the regulator trying to prove a failure. GDPR Article 5(2) requires that the controller be able to demonstrate compliance, so documentation is not a byproduct of the compliance work but part of what compliance consists of. You need a data inventory and data flow map kept current with actual processing, vendor intake assessments with a documented risk-tier determination and the reasoning behind it, and DPAs and CCPA service-provider contracts tracked with version history, so you can show the current version carries the regime-specific statutory language. It needs DPIAs covering every high-risk processing activity, including any vendor onboarding that crosses the DPIA threshold, along with a sub-processor register that records the date of each authorization and the date each change notice was received and acted on. Audit records belong in the same file, whether they come from questionnaire responses, certification reviews, or on-site findings, each dated and paired with the business's documented response to whatever gaps turned up. Technical test logs need to show that opt-out mechanisms, GPC signal recognition, and data-sharing stops actually worked on the dates they were tested, and employee training records on privacy rights requests and vendor management round out the file.

The Tractor Supply settlement offers a working model of what regulators now expect this record to look like in practice: the company had to confirm in writing to the Enforcement Division that required contractual terms were in place with all external recipients of its customers' personal information, demonstrating compliance on demand. Purpose-built vendor governance platforms, among them DataGrail, OneTrust, and Securiti, along with contract intelligence tools like Sirion that track DPA obligation status across an entire vendor portfolio, can produce that kind of record. The specific platform matters less than the discipline of keeping it current. The businesses that come through the current enforcement wave intact will not necessarily be the ones with the fewest violations on record. They will be the ones that can show, on demand and in writing, that they built a system to find and fix those violations before a regulator had to find them first.