No.

Under the final regulations promulgated by the California Attorney General, where a business collects information as a service provider for another business, the service provider has no obligation to present its privacy policy (assuming the business meets the definition of a “service provider”).  “To the extent that a business directs a second business to collect personal information directly from a consumer, or about a consumer, on the first business’s behalf, and the second business would otherwise meet the requirements and obligations of a ‘service provider’ under the CCPA and these regulations, the second business shall be deemed a service provider of the first business for purposes of the CCPA and these regulations."¹ Moreover, a business is not required to provide a privacy notice (or a notice of collection) to a consumer immediately when it collects information indirectly, provided that the business does not sell the data.  Specifically, the final regulations state that “[a] business that does not collect personal information directly from the consumer does not need to provide a notice at collection to the consumer if it does not sell the consumer’s personal information.”²

For more information and resources about the CCPA visit http://www.CCPA-info.com.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. CCPA Regulation 999.314(b).

2. CCPA Regulation 999.305(d).

[View source.]