Privacy notices

CalOPPA: the baseline for every commercial website

The California Online Privacy Protection Act requires an operator of a commercial website or online service that collects personally identifiable information about California residents to conspicuously post a privacy policy (Bus. & Prof. Code § 22575(a)). The policy must:

• identify the categories of personally identifiable information collected and the categories of third parties it's shared with;
• describe any process for consumers to review and request changes to their information;
• describe how you notify consumers of material changes;
• state the policy's effective date;
• disclose how you respond to browser "Do Not Track" signals or similar mechanisms; and
• disclose whether other parties may collect information about consumers' online activities over time and across different websites when they use your site.

Source: Bus. & Prof. Code § 22575(b). An operator violates CalOPPA by failing to comply either knowingly and willfully, or negligently and materially (§ 22576).

The CCPA privacy policy

A CCPA business must post an online privacy policy and update it at least once every 12 months (Civ. Code § 1798.130(a)(5)). Link to it conspicuously from your homepage using the word "privacy," and for mobile apps from the download or landing page and the app's settings menu (11 CCR § 7011(d)). It must be printable. Its required contents (11 CCR § 7011(e)) include:

• the categories of personal information collected in the last 12 months, their sources, and the purposes for collecting them;
• the categories sold or shared and to whom, and the categories disclosed for a business purpose, or a statement that you don't sell or share;
• whether you have actual knowledge that you sell or share personal information of consumers under 16;
• whether you use sensitive personal information beyond the permitted purposes;
• an explanation of each consumer right and how to exercise it, including how you verify requests and how authorized agents can submit them;
• how you process opt-out preference signals such as Global Privacy Control;
• where applicable, the rights to opt out of and access information about automated decisionmaking technology;
• a contact for questions; and
• the date the policy was last updated.

Notice at collection

At or before the point of collection, tell consumers the categories of personal information (including sensitive personal information) you collect, the purposes, whether each category is sold or shared, and how long you keep each category or the criteria you use to decide (Civ. Code § 1798.100(a)). The notice must also link to your opt-out notice, if you sell or share, and to your privacy policy (11 CCR § 7012(e)).

• No notice, no collection. If you don't give the notice, you may not collect the information (11 CCR § 7012(d)).
• Online, a conspicuous link to the relevant section of your privacy policy can serve as the notice (11 CCR § 7012(f)).
• Offline and in person, use a printed form, signage, or an oral notice, as appropriate.
• Third parties that control collection on your site, such as ad networks, have their own notice duty (11 CCR § 7012(g)).

"Do Not Sell or Share" and "Limit" links

If you sell or share personal information, post a clear and conspicuous link titled "Do Not Sell or Share My Personal Information." If you use sensitive personal information for purposes beyond those permitted, post a link titled "Limit the Use of My Sensitive Personal Information." Instead of the two links, you may use a single link (Civ. Code § 1798.135(a)).

• Put the links in the header or footer of your homepage, and lead them to a notice that explains the right and includes an interactive form (11 CCR §§ 7013, 7014).
• The single Alternative Opt-out Link must be titled "Your Privacy Choices" or "Your California Privacy Choices," appear with the official opt-out icon, and let consumers exercise both rights (11 CCR § 7015).
• If you don't sell or share and your privacy policy says so, no opt-out notice or link is required (11 CCR § 7013(g)).
• If you allow opt-outs through a qualifying opt-out preference signal in the way the regulations require, the statute doesn't require the links (Civ. Code § 1798.135(b); 11 CCR § 7025).

Notice of financial incentive

Loyalty programs, discounts and other benefits tied to personal information need a notice of financial incentive before the consumer opts in. It must include a summary, the material terms, how to opt in, the right to withdraw at any time, and a good-faith estimate of the value of the consumer's data with the method used to calculate it (11 CCR § 7016; Civ. Code § 1798.125(b)).

Design rules: no dark patterns

Consent obtained through a "dark pattern," a user interface that substantially subverts or impairs the consumer's choice, is not consent (Civ. Code § 1798.140(h), (l)). The regulations require easy-to-understand language and symmetry in choice: the privacy-protective option shouldn't take more steps than the other option (11 CCR § 7004). CalPrivacy cited asymmetrical cookie choices in its Honda decision.

Checklist

• A privacy policy linked from the homepage with the word "privacy," with a visible last-updated date less than 12 months old.Civ. Code § 1798.130(a)(5); 11 CCR § 7011
• CalOPPA disclosures: Do Not Track response and third-party tracking.Bus. & Prof. Code § 22575(b)(5)–(6)
• A description of how you process Global Privacy Control.11 CCR § 7011(e)
• Retention periods by category in the notice at collection.Civ. Code § 1798.100(a)(3)
• Separate notices at collection for employees, job applicants and contractors.Civ. Code § 1798.100; 11 CCR § 7012
• Offline notices wherever you collect in person or by phone.11 CCR §§ 7012, 7013(e)
• "Do Not Sell or Share" and "Limit" links, or "Your Privacy Choices," if you sell, share or use sensitive data beyond permitted purposes.Civ. Code § 1798.135; 11 CCR §§ 7013–7015
• Cookie and consent screens where "decline" is as easy as "accept."11 CCR § 7004
• A notice of financial incentive for any loyalty or discount program.11 CCR § 7016
• Request metrics published by July 1, if you handle 10 million or more consumers a year.11 CCR § 7102

Related guides

• ExplainerHonoring Global Privacy Control and other opt-out signalsCalifornia requires businesses that sell or share personal information to honor Global Privacy Control, display that they did, and apply it across devices for known users.
• Topic guideConsumer privacy and consumer rightsA plain-English guide to the CCPA: who is covered, consumer rights to know, delete, correct and opt out, response deadlines, Global Privacy Control, and recent enforcement.

Official sources

• Business and Professions Code §§ 22575–22579 (CalOPPA)
• Civil Code § 1798.100, § 1798.130, § 1798.135
• 11 Cal. Code Regs. §§ 7004, 7010–7016, 7102 (CalPrivacy)