Transactional

September 2023

Drafting a CCPA/CPRA Privacy Policy

The California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), requires covered entities to provide specific disclosures about their information protection practices in a public privacy policy.

Beth Magnuson, Practical Law

This is an excerpt, published on September 1, 2023.

Access the complete, regularly updated version on Practical Law→
  • A business must first understand how it obtains, uses, stores, shares, sells, and protects personal data
  • A business must clearly explain when data that directly falls into a sensitive information category is not sensitive
  • The CCPA allows each business to adopt a policy format that best fits its activities

The CCPA, as amended by the CPRA (collectively, CCPA), grants California residents enhanced rights regarding their personal information and imposes various data protection duties on certain entities conducting business in California. It also establishes specific public notification obligations for covered businesses that collect, share, or sell personal information about California residents.

The CPRA amendments to the CCPA took effect on January 1, 2023 and became enforceable on July 1, 2023. The CPRA added new consumer privacy protections and created the first state agency focused exclusively on privacy, the California Privacy Protection Agency (Agency). On March 29, 2023, California’s Office of Administrative Law approved the Agency’s final regulations to implement the CPRA amendments (CCPA Regulations), but enforcement of the CCPA Regulations is stayed until March 29, 2024. (Cal. Civ. Code §§ 1798.100 to 1798.199.100; Cal. Code Regs. tit. 11, §§ 7000 to 7304; for more on the development of implementing regulations for the CPRA, see CPRA Regulation Tracker on Practical Law.)

Given the CCPA’s broad reach, it is likely to significantly impact entities both inside and outside California that collect and process California residents’ personal information. This article explains the requirements under the CCPA for providing California consumers with a privacy policy when collecting, using, selling, sharing, disclosing, and retaining personal information.

(For the complete version of this resource, which includes information on the CCPA’s other disclosure obligations, such as collection notices, opt-out right notices, right to limit notices, and financial incentive notices, see Drafting Privacy Policies and Notices (CCPA and CPRA) on Practical Law; for a collection of resources to help counsel understand, prepare for, and meet the requirements of the CCPA, see California Privacy Toolkit (CCPA and CPRA).)

Separate Notice Versus General Application

As a state law, the CCPA’s coverage only extends to businesses operating within California’s jurisdictional reach. The CCPA places thresholds on a covered business’s size or personal information sales to limit its impact on small businesses. Only California residents are entitled to receive the CCPA’s required information disclosures. (For more on covered businesses and protected individuals under the CCPA, see Understanding the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) on Practical Law.)

A business with a nationwide customer base or operation faces the choice of deciding whether to:

  • Provide the CCPA’s consumer rights and required disclosures only to consumers residing in California and develop separate privacy practices for consumers located elsewhere.
  • Elevate the CCPA’s requirements to a company-wide standard and extend its protections to all US-based customers.

A business that chooses to limit the CCPA’s protections to California residents may have to:

  • Determine whether each customer or website visitor qualifies as a California resident.
  • Change internal systems to track residential statuses and implement processes for updating statuses when individuals move.
  • Provide California residents with:
    • separate websites; and
    • separate or supplemental privacy policies.
  • Establish separate internal procedures and systems for handling California residents’ personal information.
Whichever option a business chooses, accurately providing the CCPA’s required disclosures requires the business to have a full understanding of exactly how it collects, obtains, uses, stores, shares, sells, and protects personal information.

Businesses should consider that new consumer privacy laws in other states may increase the burden and difficulty of adopting state-by-state approaches. (For a collection of resources to assist counsel in advising clients about US state-specific privacy, data protection, and cybersecurity requirements, see State Data Privacy Laws Toolkit on Practical Law.)

A business that chooses to adopt one common approach for all US customers should compare its current privacy notices to the CCPA’s requirements and make any necessary adjustments.

Whichever option a business chooses, accurately providing the CCPA’s required disclosures requires the business to have a full understanding of exactly how it collects, obtains, uses, stores, shares, sells, and protects personal information. To accomplish this, most businesses start by developing detailed data maps that track and visualize how information moves through its systems during the data lifecycle. (For more on developing data maps and other considerations involved in drafting a privacy notice, see Drafting Privacy Notices on Practical Law; for a model questionnaire that counsel can use to assess an organization’s personal information collection and handling practices, with explanatory notes and drafting tips, see Privacy Audit Questionnaire on Practical Law.)

Privacy Policy Elements

The CCPA’s general consumer privacy notice obligations extend over several different sections that sometimes overlap or cross-reference each other. To help businesses comply with these obligations, the CCPA Regulations require all businesses to provide consumers with a privacy policy that:

  • Describes its information practices, including how it collects, uses, discloses, sells, shares, and retains personal information.
  • Discloses the consumer’s personal information rights. (Cal. Code Regs. tit. 11, §§ 7001(o), (w) and 7011.)

While the CCPA Regulations do not prescribe a specific format, the privacy policy must include the following elements:

  • A description of the business’s information practices. This comprehensive description of the business’s online and offline practices must identify or provide:
    • the personal information categories the business collected about consumers in the preceding 12 months, described using the personal information definition’s specific terms;
    • the categories of sources from which the business collected personal information;
    • the specific business or commercial purposes for collecting personal information, using a description that provides consumers with a meaningful understanding of why the business collects it;
    • the personal information categories, if any, the business sold or shared to third parties in the preceding 12 months and the categories of third parties to whom each information category was sold or shared (or a statement that the business did not sell or share personal information to third parties);
    • the specific business or commercial purposes for selling or sharing consumers’ personal information, using a description that provides consumers with a meaningful understanding of why the business sells or shares it;
    • a statement disclosing whether the business has actual knowledge that it sells or shares personal information about consumers under age 16;
    • the personal information categories, if any, the business disclosed for a business purpose to third parties in the preceding 12 months and the categories of third parties to whom each information category was disclosed (or a statement that the business did not disclose personal information to third parties);
    • the specific business or commercial purposes for disclosing consumers’ personal information, using a description that provides consumers with a meaningful understanding of why the business disclosed it; and
    • a statement disclosing whether the business uses or discloses sensitive personal information for purposes beyond what the CCPA specifically permits (Permitted SPI Purposes).
  • A description of consumers’ rights. This description must explain the different rights that consumers have under the CCPA regarding their personal information.
  • Instructions for exercising consumer rights. The instructions must explain how consumers can exercise their CCPA rights and what consumers can expect from that process, and provide contact information for questions or concerns.
  • The date the business last updated the policy. The privacy policy should provide the date that the policy was last updated.
  • Statistical metrics. Businesses that meet certain size thresholds must provide specific metrics on their responses to consumer rights requests. (Cal. Civ. Code §§ 1798.100(a), 1798.105, 1798.115, 1798.120, and 1798.130; Cal. Code Regs. tit. 11, § 7011(e).)

Businesses should also consider including sections that describe:

  • The personal information retention periods disclosed in their separate CCPA collection notices.
  • Deidentified patient information disclosures (if the business sells or discloses deidentified patient information).

Many US-based privacy policies present these elements in a different order. One typical formulation organizes the policy along the following topics:

  • Personal information types, sources, and uses.
  • Personal information disclosures.
  • Consumer rights description and request process.

(For the complete version of this resource, which includes a section-by-section discussion of the different consumer notice requirements in the CCPA and CCPA Regulations, see Drafting Privacy Policies and Notices (CCPA and CPRA) on Practical Law.)

Personal Information Categories

A CCPA-compliant privacy policy must describe the categories of personal information that the business collected about consumers during the past 12 months (Cal. Civ. Code §§ 1798.110(c)(1) and 1798.130(a)(5)(B); Cal. Code Regs. tit. 11, § 7011(e)(1)(A)). The privacy policy must present these information category disclosures in a way that provides consumers with a meaningful understanding of what the business collects (Cal. Code Regs. tit. 11, § 7011(e)(1)(A)).

The CCPA defines personal information as any information that either directly or indirectly:

  • Identifies, relates to, or describes a particular consumer or household.
  • Is reasonably capable of being associated with or could reasonably be linked to a particular consumer or household. (Cal. Civ. Code § 1798.140(v)(1).)

Notably, the CCPA protects data even if it does not relate to a single individual, because it covers households and unique devices that consumers might share. It also protects data even when a record does not contain a name. (Cal. Civ. Code § 1798.140(i), (q), (aj).) This means that personal information under the CCPA includes items such as profiles associated with internet cookie identifiers or household television viewing profiles. The CCPA also clarifies that its provisions apply regardless of the data collection method. For example, it covers personal information collected electronically, recorded over the phone, entered on printed forms, or generated by an algorithm. (Cal. Civ. Code § 1798.175.)

The personal information definition provides 12 different categories of data that could qualify as personal information. It further breaks down the 12th category (sensitive personal information) into nine sub-categories. Businesses must use and reference these 21 statutory personal and sensitive personal information categories in their privacy policy’s personal information collection disclosure (Cal. Civ. Code § 1798.130(c)). The 21 categories are:

  • Identifiers, such as internet protocol (IP) addresses that identify or relate to a particular consumer or household.
  • The personal information categories described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)).
  • Characteristics of protected classifications under California or federal law.
  • Commercial information.
  • Biometric information.
  • Internet or other similar network, browsing, or search activity.
  • Geolocation data.
  • Audio, electric, visual, thermal, olfactory, or similar information.
  • Professional or employment-related information.
  • Non-publicly available educational information under the Family Educational Rights and Privacy Act (FERPA) and related regulations (20 U.S.C. § 1232g; 34 C.F.R. §§ 99.1 to 99.67).
  • Inferences drawn from other personal information to create consumer profiles.
  • Sensitive personal information, which includes nine sub-categories for:
    • government identifiers (such as a consumer’s Social Security, driver’s license, state identification card, or passport number);
    • complete account access credentials (such as usernames, account numbers, or card numbers combined with any required access or security code or password);
    • precise geolocation;
    • racial or ethnic origin, religious or philosophical beliefs, or union membership;
    • genetic data;
    • mail, email, or text messages contents;
    • unique identifying biometric information;
    • health information; and
    • sex life or sexual orientation information. (Cal. Civ. Code § 1798.140(v)(1), (ae).)

Businesses should be aware that the CCPA lists sensitive personal information as a specific and separate personal information category (Cal. Civ. Code § 1798.140(v)(1)(L)). This means that any disclosure asking for the categories of personal information must, by definition, include any sensitive personal information as one of those categories.

Sensitive Personal Information Exception

The CCPA includes an important but challenging exception to when personal information qualifies as sensitive. Information that would otherwise fall within one of the CCPA’s sensitive personal information subcategories can avoid that designation if the business collects or processes it without the purpose of inferring characteristics about a consumer. Businesses can treat information that qualifies for the exception as regular personal information for CCPA compliance purposes, including in their privacy policy’s information category disclosures. (Cal. Civ. Code § 1798.121(d).)

The consumer’s right to limit the use and disclosure of their sensitive personal information makes this classification particularly significant (see Permitted SPI Purposes and Consumer Rights below). However, the exception’s subjective nature may make providing clear and meaningful personal information category disclosures difficult, especially when a business collects data that directly falls into a sensitive personal information category, like a consumer’s racial origin or medical diagnosis. There are also open questions on whether a business could ever collect certain sensitive personal information, like precise geolocation or genetic data, without inferring characteristics about the consumer.

A business’s privacy policy should clearly explain if and why that business is not treating data that directly falls into one of the sensitive personal information categories (such as racial origin or a medical diagnosis) as sensitive. The business should also ensure that the information category descriptions provide the consumer with a meaningful understanding of what the business collects. This may require, for example, providing two different sensitive personal information category descriptions, separating out sensitive personal information that is:

  • Subject to the consumer’s right to limit.
  • Not subject to the consumer’s right to limit because the business does not collect or use it to infer a consumer’s characteristics.
A business’s privacy policy should clearly explain if and why that business is not treating data that directly falls into one of the sensitive personal information categories (such as racial origin or a medical diagnosis) as sensitive.

The privacy policy should also avoid making blanket statements that do not clearly explain the business’s underlying assumptions or actions. For example, the CCPA directly lists Social Security numbers as a type of sensitive personal information (Cal. Civ. Code § 1798.140(ae)(1)(A)). If the business collects consumers’ Social Security numbers, the privacy policy should not make a blanket statement that the business does not collect sensitive personal information without clarifying why it does not consider that information sensitive or subject to the CCPA’s limitation right. The blanket statement could confuse consumers unless the business further explains that, while it collects Social Security numbers, it does not use them to infer any characteristics about the consumer.

Best Practices for Information Category Disclosures

When drafting the privacy policy’s personal information category disclosures, a business should:

  • Review its operations to ensure that the privacy policy disclosures accurately reflect the types of personal information it collects.
  • Recognize that the CCPA’s broader personal information and collection definitions may require a review of business processes that involve:
    • obtaining personal information from third parties; or
    • generating personal information by creating profiles.
  • Match the personal information collected over the past 12 months to the closest CCPA personal or sensitive personal information category.
  • Carefully consider how to classify and disclose information falling within a sensitive personal information category that the business does not collect or use to infer a consumer’s characteristics.

A business can also leverage different visual presentation methods to provide consumers with a meaningful understanding of what personal information categories it collects (Cal. Code Regs. tit. 11, § 7011(e)(1)(A)). For example, to improve reader comprehension, a business could:

  • Present this information in a table.
  • Develop alternate infographic formats or icons.
  • Use interactive forms that pop-up more information and specific examples for each category when the reader hovers over the category name.

Personal Information Sources

A CCPA-compliant notice must specifically describe the categories of sources from which the business collects personal information (Cal. Civ. Code § 1798.110(c)(2); Cal. Code Regs. tit. 11, §§ 7001(e) and 7011(e)(1)(B)).

A business collects personal information under the CCPA when it uses any means to obtain it, including buying, renting, gathering, or otherwise accessing it (Cal. Civ. Code § 1798.140(f)). Common means to collect personal information include:

  • Actively from the consumer.
  • Passively from clickstream data that website cookies gather.
  • By observing the consumer’s behavior.
  • By purchasing information from data brokers.

While the CCPA does not establish specific source category types, businesses should remain mindful of the CCPA’s broad collection definition when developing their category list. The source category descriptions should be sufficiently detailed to provide consumers with a meaningful understanding of the person or entity type that provided the personal information (Cal. Code Regs. tit. 11, § 7001(e)). Generic, overly broad, or vague category descriptions may receive greater scrutiny.

Source category descriptions for the types of people and entities that provide personal information to a business may include:

  • Customers, through direct interactions and forms.
  • Internet websites, through passive collection of information about a customer’s interactions, including page clicks, time spent, or other automatically collected metadata.
  • Internet cookies.
  • Advertising networks.
  • Internet service providers.
  • Data analytics providers.
  • Operating systems and platforms.
  • Observations from monitoring behavior, such as store video camera or surveillance systems.
  • Search terms.
  • Automated license plate readers.
  • Data brokers or resellers.
  • Social media services, like Facebook.
  • Government databases.
  • Service providers.

When drafting the privacy policy, the business should:

  • Describe the business’s sources with sufficient detail to provide clear and meaningful disclosures about where acquired personal information originated.
  • Avoid generic or overly broad language.
  • Carefully review its personal information data flows to provide clear and accurate disclosures.

Business or Commercial Purposes

The CCPA privacy policy must identify the business or commercial purposes for collecting, selling, sharing, or disclosing personal information (Cal. Civ. Code §§ 1798.100(a)(1)-(2) and 1798.110(c)(3); Cal. Code Regs. tit. 11, § 7011(e)(1)(C), (F), (J)). A business should therefore ensure that its privacy policy comprehensively describes all current and reasonably anticipated use cases in a manner that provides consumers with a meaningful understanding of the expected uses to meet the CCPA’s disclosure requirements (Cal. Code Regs. tit. 11, § 7011(e)). However, the CCPA also imposes purpose limitation and data minimization requirements, which mean that the business must:

  • Limit its collection, use, retention, and sharing of a consumer’s personal information to actions reasonably necessary and proportionate to achieve:
    • the purposes for which the personal information was collected or processed; or
    • another disclosed purpose that is compatible with the context of the personal information collection.
  • Not further process the information in a manner incompatible with those purposes. (Cal. Civ. Code § 1798.100(c).)

This essentially restricts the permitted business or commercial purposes to those which are reasonable given the personal information collection’s circumstances and compatible with the original collection’s context (Cal. Code Regs. tit. 11, § 7002). Consequently, the business should also ensure that any disclosed purposes are consistent with and do not exceed what a consumer would reasonably expect based on how their personal information was first obtained.

The CCPA Regulations do not directly tie the purpose disclosures to the last 12 months as they do for personal information collections (see Personal Information Categories above). However, as a best practice, drafters should ensure that the privacy policy, at a minimum, describes all the purposes for which the business actually used, sold, shared, or disclosed the personal information it collected during the last 12 months.

Publishing clear, complete, and specific use purpose descriptions also benefits the business by providing transparency and lowering potential enforcement or compliance risks.

Consumer Rights

The CCPA establishes several new consumer rights regarding personal information, including:

  • The individual right to know whether the business collected, sold, shared, or disclosed for a business purpose the consumer’s personal information, with specific details (right to know).
  • The specific pieces of personal information that the business collected (data portability right).
  • The right to delete personal information.
  • The right to correct inaccurate personal information.
  • The right to opt-out of personal information sales or sharing their personal information for cross-context behavioral advertising purposes (see Personal Information Sales and Sharing below).
  • The right to limit the use and disclosure of sensitive personal information to specifically permitted purposes (see Permitted SPI Purposes below).
  • Freedom from discrimination. (Cal. Civ. Code §§ 1798.105 to 1798.125.)

A CCPA-compliant privacy policy must describe these personal information rights to consumers (Cal. Civ. Code § 1798.130(a)(5)(A); Cal. Code Regs. tit. 11, § 7011(e)(2)). However, a business that does not sell or share personal information may omit the opt-out right description, and a business that does not use sensitive personal information beyond the Permitted SPI Purposes may omit the limitation right description (Cal. Code Regs. tit. 11, § 7011(e)(2)(C)-(D)). (For more on consumer rights regarding personal information, see Responding to Consumer Rights Requests (CCPA and CPRA) on Practical Law.)

Third Party Categories

A CCPA-compliant privacy policy must list the categories of third parties to whom the business discloses personal information, including by selling or sharing it (Cal. Civ. Code §§ 1798.110(c)(4) and 1798.130(a)(5)(B)(iv)). The CCPA Regulations clarify that the business should disclose these categories in its required policy statements on personal information sales or sharing and in its business purpose disclosures (Cal. Code Regs. tit. 11, §§ 7001(f) and 7011(e)(1)(E), (I); see Personal Information Disclosures for a Business Purpose and Personal Information Sales and Sharing below).

The CCPA does not establish specific categories describing the different types of third parties. However, the CCPA Regulations define “categories of third parties” as meaningful descriptions of the third parties with whom a business shares personal information (Cal. Code Regs. tit. 11, § 7001(f)). Examples of categories of third parties include:

  • Data brokers or aggregators.
  • Data analytics providers.
  • Advertisers and advertising networks.
  • Social media companies.
  • Internet cookie information recipients, like Google.
  • Affiliates.
  • Partners.
  • Parent or subsidiary organizations.
  • Government entities.

When developing their third party category list, businesses should keep in mind the CCPA’s purpose of providing reasonable and accessible disclosures. As with personal information source categories, generic, overly broad, or vague third party category descriptions may receive greater scrutiny.

When drafting the privacy policy, the business should:

  • Select descriptive category names that provide clear and meaningful disclosures about the different types of third parties that purchase, receive, view, obtain, or access personal information from the business.
  • Avoid generic or overly broad language.
  • Carefully review its personal information data flows to provide clear and accurate disclosures.

Personal Information Disclosures for a Business Purpose

The CCPA requires a business’s privacy policy to contain a statement about personal information disclosures made for a business purpose during the preceding 12 months that either:

  • Lists the categories of personal information disclosed for a business purpose, using the CCPA’s personal information categories that most closely describe the personal information (see Personal Information Categories above).
  • States that no such disclosures occurred. (Cal. Civ. Code §§ 1798.115(c)(2) and 1798.130(a)(5)(C)(ii).)

The CCPA Regulations:

  • Narrow this disclosure requirement to only cover personal information categories disclosed for a business purpose to third parties in the preceding 12 months.
  • Add the requirements that a business must:
    • list, for each personal information category identified, the categories of third parties to whom the information was disclosed (see Third Party Categories above); and
    • identify the specific business purposes for disclosing the consumer’s personal information, in a manner that provides consumers with a meaningful understanding of why the information is disclosed (see Business or Commercial Purposes above; Cal. Code Regs. tit. 11, § 7011(e)(1)(H)-(J).)

This creates a potential gap around personal information disclosed to service providers or contractors, which are almost always for a business purpose but who by definition are not third parties (Cal. Civ. Code § 1798.140(ai)). As a best practice, businesses should consider providing similar disclosures for personal information categories disclosed to service providers and contractors.

Personal Information Sales and Sharing

Under the CCPA, the privacy policy for a business that sells or shares personal information must:

  • State whether or not the business sells or shares personal information, including sensitive personal information.
  • List the categories of personal information it sold or shared during the preceding 12 months, if applicable:
    • using the CCPA’s personal information and sensitive personal information categories that most closely describe the personal information (see Personal Information Categories above); and
    • providing, for each personal information category identified, the categories of third parties to whom it sold or shared the personal information (see Third Party Categories above).
  • Identify the specific business or commercial purposes for selling or sharing a consumer’s personal information in a manner that provides consumers with a meaningful understanding of why the business sold or shared the information (see Business or Commercial Purposes above).
  • State whether the business has actual knowledge that it sells or shares the personal information of consumers under age 16.
  • Inform consumers about their personal information sales or sharing opt-out rights (see Consumer Rights above).
  • Provide the business’s opt-out right notice content or a link to its location. (Cal. Civ. Code §§ 1798.115(c)(1), 1798.120(b), 1798.130(a)(5)(C)(i), and 1798.135; Cal. Code Regs. tit. 11, § 7011(c)(1)(D)-(G).)

The CCPA permits the Agency to create a user-directed, opt-out preference signal standard that businesses can use as an alternative to the opt-out right notice links (Cal. Civ. Code § 1798.135(b); Cal. Code Regs. tit. 11, § 7025). A business that processes opt-out preference signals in a frictionless manner may replace the privacy policy’s opt-out notice links with a qualifying statement about that process (Cal. Civ. Code § 1798.135(c)(2); Cal. Code Regs. tit. 11, § 7025(g)(2)). (For more on the Agency’s development of implementing regulations for the CPRA, see CPRA Regulation Tracker on Practical Law; for more on frictionless opt-out preference signal processing, see Drafting Privacy Policies and Notices (CCPA and CPRA) on Practical Law.)

Notably, the CCPA also restricts third-party sale recipients from reselling or sharing the personal information unless the consumer receives explicit notice of the potential resale or sharing and an opportunity to opt-out (Cal. Civ. Code § 1798.115(d)).

Permitted SPI Purposes

The CCPA grants consumers the right to limit the use or disclosure of their sensitive personal information to specific Permitted SPI Purposes (Cal. Civ. Code §§ 1798.121(a) and 1798.140(e)(2), (4), (5), (8); Cal. Code Regs. tit. 11, § 7027(m)). (For more on what the Permitted SPI Purposes include, see Understanding the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) on Practical Law.)

To help consumers exercise this right, a business’s privacy policy must state whether it uses or discloses sensitive personal information beyond the Permitted SPI Purposes (Cal. Civ. Code §§ 1798.121(a) and 1798.135(a); Cal. Code Regs. tit. 11, § 7011(e)(1)(K)). If the business does, then its privacy policy must also:

  • Disclose that consumers have the right to limit the use or disclosure of their sensitive personal information to just the Permitted SPI Purposes.
  • Tell consumers how to exercise their right to limit sensitive personal information use and disclosure.
  • Provide either:
    • the business’s sensitive personal information right to limit notice content or a link to its location; or
    • once the Agency establishes an opt-out preference signal standard for sensitive personal information limitation requests, a statement that the business honors those signals. (Cal. Civ. Code §§ 1798.121(a) and 1798.135(c)(2); Cal. Code Regs. tit. 11, § 7011(e)(2)(E), (3)(D), (F)-(G).)

Consumer Request Process

A CCPA-compliant privacy policy must also inform consumers how to exercise their personal information rights and what to expect from the process. It must include:

  • An explanation of the methods by which the consumer can exercise their CCPA rights.
  • Instructions for submitting CCPA rights requests, including any links to an online request form or portal, if the business offers one.
  • The contents of (or a link to) its:
    • opt-out right notice, if the business sells or shares personal information and is required to provide one; and
    • right to limit notice, if the business uses or discloses sensitive personal information beyond the Permitted SPI Purposes and is required to provide one.
  • A general description of the business’s process for verifying consumer requests to know, delete, or correct (when applicable), including any information the consumer must provide with the request.
  • An explanation of how the business will process an opt-out preference signal and how the consumer can use an opt-out preference signal, including whether and in what circumstances the signal applies to the device, browser, consumer account, and offline sales.
  • Information on how consumers can implement opt-out preference signals for the business to process in a frictionless manner, if the business offers this option.
  • Instructions on how an authorized agent can make CCPA-related requests on the consumer’s behalf.
  • A description of the business’s processes to allow consumers under 16 years of age to opt-in to personal information sales, if the business has actual knowledge that it sells or shares those minors’ personal information.
  • Contact information consumers can use to submit questions or concerns about the business’s information practices, using a method that reflects how the business primarily interacts with consumers (see Contact Information below). (Cal. Code Regs. tit. 11, § 7011(e)(3).)

The CCPA Regulations clarify that the privacy policy disclosure requirements related to consumers under 16 years of age apply even if the business only targets consumers under 13 years of age or only targets consumers between 13 and 15 years of age (Cal. Code Regs. tit. 11, §§ 7070, 7071, and 7072(a)).

(For more on the CCPA’s consumer rights submission and response requirements, see Responding to Consumer Rights Requests (CCPA and CPRA) on Practical Law.)

Consumer Rights Request Metrics

The CCPA Regulations require that the privacy policy for large businesses disclose specific metrics on the receipt of and response to verified consumer rights requests (Cal. Code Regs. tit. 11, § 7011(e)(5)). A large business is one that knows or should know that it alone or jointly buys, receives, sells, shares, or otherwise makes available personal information from more than ten million consumers for commercial purposes in a calendar year (Cal. Code Regs. tit. 11, § 7102(a)).

Deidentified Patient Information

On September 25, 2020, California passed Assembly Bill No. 713 (AB 713), which added a deidentified patient information disclosure requirement to Cal. Civ. Code § 1798.130. However, this new disclosure requirement does not appear in the CPRA because it was added after the ballot initiative’s text was finalized.

The CPRA provides that its provisions prevail over any conflicting legislation enacted after January 1, 2020 (Cal. Prop. 24 § 25(d) (2020)). Arguably, AB 713 does not conflict with the CPRA because AB 713’s disclosure requirement is consistent with and furthers the CCPA’s purposes. However, the corresponding CPRA section approved by the voters did not contain AB 713’s new language, and the legislature has not reenacted the provision. As a result, the CPRA appears to have overwritten the disclosure requirement of AB 713.

Nevertheless, a business that sells or discloses deidentified patient information exempt from the CCPA should consider including AB 713’s required statement in its privacy policy as a best practice and disclose whether it:

  • Sells or discloses deidentified patient information.
  • Used one or more of HIPAA’s deidentification methodologies, specifically:
    • the HIPAA expert determination method (45 C.F.R. § 164.514(b)(1)); or
    • the HIPAA safe harbor method (45 C.F.R. § 164.514(b)(2); see Cal. Civ. Code § 1798.130(a)(5)(D) (Sept. 25, 2020 to Dec. 31, 2022)).

Retention Period

The CCPA requires that a business disclose, at or before the point of collection, the length of time it intends to retain each category of personal information and sensitive personal information (Cal. Civ. Code § 1798.100(a)(3)). If providing the exact retention period is not possible, the business may instead describe the criteria it will use to determine how long it plans to retain that category of personal information or sensitive personal information. When setting the retention period, the business should remember that the CCPA prohibits it from retaining a consumer’s personal information for longer than is reasonably necessary to achieve the disclosed collection and use purposes. (Cal. Civ. Code § 1798.100(a)(3).)

While the CCPA Regulations’ privacy policy elements do not directly include disclosing the expected retention period, the privacy policy’s stated purpose is to provide consumers with a comprehensive description of the business’s online and offline information practices (Cal. Code Regs. tit. 11, § 7011(a), (e)). By definition, a business’s information practices include its practices regarding the retention of personal information (Cal. Code Regs. tit. 11, § 7001(o)). Consequently, businesses should consider including this information in their privacy policy as a best practice.

Contact Information

A business’s privacy policy must tell consumers who to contact if they have questions or concerns about its privacy policies and practices (Cal. Code Regs. tit. 11, § 7011(e)(3)(J)). Privacy policies often list the business’s chief privacy officer or data protection officer as the primary contact point.

However, the CCPA Regulations also require the business to use a contact method that reflects how it primarily interacts with consumers (Cal. Code Regs. tit. 11, § 7011(e)(3)(J)). Businesses should consider if or how they may integrate privacy questions or complaints into their regular customer service process.

Presentation Requirements

The CCPA and CCPA Regulations do not establish a required form or format for compliant privacy policies. Rather, they allow each business to adopt a policy format that best fits the business’s activities. However, they do direct businesses to:

  • Adopt a form that is easy to read and understandable to an average consumer.
  • Use plain, straightforward language and avoid technical or legal jargon.
  • Use a format that makes the policy readable on smaller screens, if applicable.
  • Translate the policy, if applicable, so it appears in the language the business ordinarily uses to provide sales announcements, contracts, disclaimers, or other information to consumers.
  • Ensure that consumers with disabilities can access the policy by, for example:
    • following generally recognized industry standards, such as the Web Content Accessibility Guidelines published by the World Wide Web Consortium for online notices (W3C: Web Content Accessibility Guidelines (WCAG) Overview); and
    • describing how a consumer with a disability may access the policy in an alternative format.
  • Provide a format that allows consumers to print it out as a single document. (Cal. Civ. Code § 1798.130(a); Cal. Code Regs. tit. 11, §§ 7003(a)-(b) and 7011(b)-(c).)
The CCPA and CCPA Regulations do not establish a required form or format for compliant privacy policies. Rather, they allow each business to adopt a policy format that best fits the business’s activities.

A business must make its privacy policy available:

  • Online through a conspicuous link using the word “privacy” on the business’s website homepage, unless it does not operate a website.
  • On a mobile app’s download or landing page and in the app’s settings menu.
  • In any California-specific description of consumers’ privacy rights.
  • Conspicuously to consumers when the business does not operate a website. (Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011(d).)

Conspicuous website links must appear in a similar manner as other similarly posted links the business uses on its homepage, for example, using the same font size and color as links that appear next to it (Cal. Code Regs. tit. 11, § 7003(c)).

(For more on privacy notice formats and drafting considerations, see Drafting Privacy Notices on Practical Law.)

Annual Review

Businesses should conduct annual reviews of their privacy policy disclosures to ensure that they remain accurate. They must update the following elements at least once every 12 months:

  • The descriptions of and submission methods for the consumers’ right to know, right to delete, right to correct, and right of no retaliation.
  • The collected personal information category list.
  • The personal information sources list.
  • The business or commercial purposes for collecting, selling, or sharing consumers’ personal information.
  • The third-party disclosure category list.
  • The separate lists of personal information categories either:
    • disclosed for a business purpose; or
    • sold or shared during the preceding 12 months (or statements that no such activities occurred). (Cal. Civ. Code § 1798.130(a)(5).)

Beth Magnuson, CIPP/US, CIPP/E, joined Practical Law from Oracle Corp., where she was managing counsel responsible for privacy and security matters. Previously she was special counsel at Faegre & Benson LLP, general counsel of Pumpkin Masters, and an intellectual property associate at Finnegan, Henderson, Farabow, Garrett & Dunner, LLP and at Welsh & Katz (now Husch Blackwell LLP).

Related Content on Practical Law

Understanding the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA)

Access on Practical Law

Responding to Consumer Rights Requests (CCPA and CPRA)

Access on Practical Law

California Privacy Toolkit (CCPA and CPRA)

Access on Practical Law

State Data Privacy Laws Toolkit

Access on Practical Law

State Consumer Privacy Laws - Overview

Access on Practical Law

State Consumer Privacy Laws - Consumer Rights

Access on Practical Law