According to the CCPA, a third party is any company or legal organization that obtains personal information from a business but does not fit the bill as a service provider. A third party must use consumers' personal information following the agreements made when it was first obtained. It should notify consumers of new or altered procedures, give them explicit notice of any additional sales of their personal information, and provide them with the option to opt-out of it.