California privacy policy rules: CCPA, CPRA, and CalOPPA

Who this law applies to

Under Civil Code section 1798.140(d), the CCPA covers a for-profit business that does business in California, collects consumers' personal information, and meets at least one test: annual gross revenues above the statutory threshold of $25,000,000, adjusted for inflation to $26,625,000 from January 1, 2025; buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50 percent or more of annual revenues from selling or sharing personal information. A consumer is a California resident, and since the CPRA amendments took full effect on January 1, 2023, that includes employees, job applicants, and business contacts. The CCPA took effect on January 1, 2020, and it is enforced by the California Privacy Protection Agency and the Attorney General. CalOPPA, in Business and Professions Code section 22575 and following, is broader in reach and narrower in content: an operator of a commercial website or online service that collects personally identifiable information from California residents must conspicuously post a privacy policy, with no revenue or volume threshold. It has applied since July 1, 2004, was amended in 2013 to add tracking disclosures, and gives an operator 30 days to comply after being notified of non-compliance.

What your privacy policy must include

For the CCPA, section 1798.130(a)(5) requires the online privacy policy to describe consumer rights and the methods for submitting requests, and to list, for the preceding 12 months, the categories of personal information collected, the categories of sources, the business or commercial purposes, the categories of third parties to which information is disclosed, the categories sold or shared, and the categories disclosed for a business purpose. Section 1798.100 adds the retention period for each category or the criteria used to decide it. Consumers can request to know, delete, and correct information, opt out of sale or sharing, limit the use of sensitive personal information where that right applies, and exercise rights without discrimination. A business that sells or shares information must provide the opt-out methods required by section 1798.135, such as a Do Not Sell or Share My Personal Information link, and the regulations require it to honour opt-out preference signals such as Global Privacy Control. The policy must be updated at least once every 12 months. For CalOPPA, section 22575(b) requires the categories of personally identifiable information collected and the categories of third parties it is shared with, the process for reviewing and requesting changes where one exists, how users are notified of material changes, the effective date, how the operator responds to browser Do Not Track signals, and whether other parties may collect information about users' online activities over time and across sites.

Categories, sale, sharing, and sensitive information

California notices use statutory categories: identifiers, customer records, protected classification characteristics, commercial information, biometric information, internet or other electronic network activity, geolocation data, sensory data, professional or employment information, education information, inferences, and sensitive personal information. Map real data flows to these categories instead of listing every category defensively. Sale means disclosing personal information to a third party for monetary or other valuable consideration, while sharing means disclosing it for cross-context behavioral advertising, whether or not money changes hands, so advertising pixels and SDKs that send browsing or app activity to ad platforms for targeted ads commonly create sharing. Disclosures to service providers and contractors under compliant contracts are generally not sales. Sensitive personal information includes government identifiers, account log-in credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, the contents of certain communications, genetic data, biometric data used for identification, and health, sex life, and sexual orientation information. If a business uses it for purposes beyond those the regulations permit, consumers have a right to limit that use and the policy must explain it; if it is used only for permitted purposes, the policy can say so. The policy must also explain how requests are verified and how authorized agents can submit them, and the process it describes needs to work in practice.

How Legal Policy Generator handles it

California coverage is split across separate clauses. A United States framework clause explains that US privacy duties vary by state, sector, and activity. The CCPA clause lists California rights, authorized-agent handling, Global Privacy Control handling, and the operator's category-level disclosure for the preceding 12 months. The CalOPPA clause states the Do Not Track response and points to the sections describing third-party collection. Exactly one of two sale-or-sharing clauses is added, depending on whether the operator reports a sale or sharing; the two are declared as conflicts, so a document can never contain both. The list below is read from the clause library each time this page is rendered.

Questionnaire answers that switch it on

Selecting California CCPA/CPRA asks whether the service reaches California residents. When it does, the questionnaire asks whether the CCPA business thresholds are met, and the California rights clause is added only when both answers are yes. At that point the Global Privacy Control handling, the authorized-agent answer, and the 12-month category disclosure become required. The sale-or-sharing answer is required whenever the CCPA module is active or other US state laws are selected, and it decides which of the two sale clauses appears. Selecting California CalOPPA is independent of the CCPA thresholds and requires a statement of how the service responds to Do Not Track signals. The US framework clause is added whenever any US module is active. In the separate Terms generator, a California subscription clause is added for automatic-renewal offers made to California customers.

Common mistakes

Stating that no personal information is sold while running cross-context behavioral advertising pixels is the most common contradiction, because sharing for such advertising is covered even without payment. A Do Not Sell or Share link that leads nowhere, or ignores Global Privacy Control, makes a published promise that does not work. Twelve-month category disclosures copied from an old version drift out of date, and the policy must be refreshed at least annually. Treating the CCPA as irrelevant because the business is located outside California ignores the doing-business test. Forgetting employees and business contacts leaves out consumers that the law has covered since 2023. For CalOPPA, saying nothing about Do Not Track is a gap; stating accurately that the service does not respond to those signals is a disclosure, while silence is not.

Common questions