California has one of the most detailed privacy policy requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CCPA and cookies.

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and codified at Cal. Civ. Code § 1798.100 et seq., requires the privacy notice to be updated every 12 months and to contain specific lists of what was collected, sold, shared, and disclosed in the preceding year.

This article focuses exclusively on what the CCPA/CPRA requires from your Privacy Policy, based on the official text of the law.

Yes, significantly. The CPRA (Proposition 24, operative since January 2023) expanded the transparency obligations of the privacy notice in three main areas:

Added the obligation to disclose the category of sensitive personal information when collected.

Added the two new mandatory links on the site: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information."

Reinforced data minimization and proportionate retention requirements, requiring the Policy to include the period the business intends to retain each category of data.

For more on what the CPRA specifically changed, we have a dedicated guide on the California CPRA. This article covers the current consolidated law.

The privacy notice must list the categories of personal information collected about consumers in the preceding 12 months (§ 1798.130(a)(5)(B)).

The CCPA/CPRA establishes specific categories that must be used for this description, under § 1798.140(v):

Identifiers (name, address, IP address, email, Social Security number, etc.).

Personal information described in Section 1798.80 of California law.

Characteristics of protected classifications under California or federal law.

Commercial information (records of property, purchase history).

Biometric information.

Internet or other electronic network activity (browsing history, search history, ad interactions).

Geolocation data.

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information.

Education information.

Inferences drawn to create profiles about preferences, characteristics, behavior, and aptitudes.

Sensitive personal information.

The privacy notice must identify the categories of sources from which consumers' personal information is collected (§ 1798.130(a)(5)(B)(ii)).

Typical sources include: the consumer directly through forms, analytics systems, advertising networks, data partners, social media, and publicly available sources.

The notice must explain what the data is used for (§ 1798.130(a)(5)(B)(iii)).

The CCPA/CPRA defines "business purpose" (§ 1798.140(e)) with specific categories: auditing ad impression counts, ensuring security and integrity, debugging errors, short-term transient use, performing services on behalf of the business, advertising and marketing (except cross-context behavioral advertising), internal research, and quality verification activities.

The notice must identify the categories of third parties with whom the business shares consumers' personal information (§ 1798.130(a)(5)(B)(iv)).

§ 1798.130(a)(5)(C) requires the privacy notice to include:

A list of categories of personal information sold or shared about consumers in the preceding 12 months, by category; or a statement that the business has not sold or shared personal information.

A list of categories disclosed for business purposes in the preceding 12 months; or a statement that no such disclosure occurred.

These two lists must be kept separate in the privacy notice.

The notice must describe the rights guaranteed by the CCPA/CPRA and the designated methods for submitting requests (§ 1798.130(a)(5)(A)):

Right to know and access (§ 1798.100, 1798.110, 1798.115).

Right to deletion (§ 1798.105).

Right to correction of inaccurate data (§ 1798.106).

Right to opt-out of sale and sharing (§ 1798.120).

Right to limit use of sensitive personal information (§ 1798.121).

Right of non-discrimination (§ 1798.125).

And the two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

§ 1798.100(a)(3) requires that, at or before the point of collection, the business inform consumers of the length of time it intends to retain each category of personal information, including sensitive personal information, or the criteria used to determine that period.

The business shall not retain a consumer's personal information for longer than is reasonably necessary for the disclosed purpose.

§ 1798.135 requires the Privacy Policy to mention and the site to provide, clearly and conspicuously:

"Do Not Sell or Share My Personal Information": a link to a page where the consumer can opt out of the sale and sharing of their data. Sharing, defined as transfer for cross-context behavioral advertising, is included even without monetary consideration.

"Limit the Use of My Sensitive Personal Information": a link that allows the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

The business may use a single combined link that clearly allows exercising both options.

Alternatively, the business may honor the opt-out preference signal of the Global Privacy Control (GPC) when sent by the consumer, instead of maintaining the links. In that case, the Policy must state that the site respects the GPC.

If the business collects sensitive personal information, the privacy notice must expressly disclose this (§ 1798.100(a)(2)).

Sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)) includes: Social Security number, driver's license, or passport number; login credentials and financial account access codes; precise geolocation; racial or ethnic origin, citizenship status, religious beliefs, union membership; contents of private communications; genetic data; neural data; biometric data for identification; health information; sex life or sexual orientation.

For each category of sensitive information collected, the Policy must explain:

For what specific purpose it is collected.

Whether it is sold or shared, and with whom.

How the consumer can limit its use (via "Limit the Use of My Sensitive Personal Information" link or via GPC).

A specific feature of the CCPA/CPRA is the 12-month lookback in access requests.

When a consumer makes an access request, the response must cover the period of 12 months preceding receipt of the request (§ 1798.130(a)(2)(B)).

After adoption of specific regulations, the consumer may request information beyond 12 months for data collected from January 1, 2022, if it is not impossible or would not involve disproportionate effort.

The Privacy Policy must mention this 12-month lookback so the consumer understands which time period is covered by their request.

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

The business must make its website available for request submission if it maintains a website.

The business cannot require the consumer to create a new account to exercise their rights. It may require use of an existing account.

Data collected for identity verification may be used only for that purpose, not for other uses (§ 1798.130(a)(7)).

If the business may have consumers under 16 years of age, the Privacy Policy must describe the special protections applicable:

For consumers between 13 and 15: the business cannot sell or share data without affirmative authorization from the consumer themselves (§ 1798.120(c)).

For consumers under 13: parental or guardian authorization is required.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

The data protection officer must ensure that the age verification process, where applicable, is operational and documented.

§ 1798.150 grants the consumer the private right of action for security breaches, with damages of US$ 100 to US$ 750 per consumer per incident.

Before initiating any action for statutory damages, the consumer must provide written notice to the business 30 days in advance. If the business cures the violation within the period and provides a written statement that no further violations will occur, no action may be initiated.

The Privacy Policy must mention this right and how the consumer can exercise it.

§ 1798.130(a)(5) requires the privacy notice to be updated at least once every 12 months.

This update must reflect what was collected, sold, shared, and disclosed for business purposes in the preceding 12 months. A generic, outdated notice is not sufficient: the business needs an internal mandatory annual review process.

Situations requiring immediate update, in addition to the annual review:

Adding a new category of data collected.

New third parties receiving data.

Changes in sale or sharing practices.

New purposes for data use.

Any change to opt-out links or submission methods.

CCPA/CPRA violations are investigated and enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.

The CPPA can impose administrative fines of up to US$ 2,500 per violation and up to US$ 7,500 for intentional violations or violations involving minors. The Attorney General can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate without any obligation to grant advance notice.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The consent management platform ensures that the opt-out and sensitive information limitation mechanisms work as described.

The GPC is honored automatically when sent by the user. Every consent interaction is logged. If the CPPA or Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.

Visible and accessible link on all pages of the site.

Updated at least once every 12 months (§ 1798.130(a)(5)).

Categories of personal information collected in the preceding 12 months (§ 1798.130(a)(5)(B)(i)).

Categories of sources of personal information (§ 1798.130(a)(5)(B)(ii)).

Business or commercial purpose for collecting, selling, or sharing (§ 1798.130(a)(5)(B)(iii)).

Categories of third parties with whom data is shared (§ 1798.130(a)(5)(B)(iv)).

List of categories sold or shared in the preceding 12 months (§ 1798.130(a)(5)(C)(i)).

List of categories disclosed for business purposes in the preceding 12 months (§ 1798.130(a)(5)(C)(ii)).

Consumer rights and how to exercise them, with process and deadlines (§ 1798.130(a)(5)(A)).

Two or more submission methods, including a toll-free telephone number (§ 1798.130(a)(1)).

"Do Not Sell or Share My Personal Information" link or statement of honoring GPC (§ 1798.135).

"Limit the Use of My Sensitive Personal Information" link when applicable (§ 1798.121, 1798.135).

Categories of sensitive personal information collected, when applicable (§ 1798.100(a)(2)).

Retention period for each category of data (§ 1798.100(a)(3)).

12-month lookback for access requests mentioned (§ 1798.130(a)(2)(B)).

Private right of action for security breaches mentioned (§ 1798.150).

Protection for minors aged 13 to 15 and under 13 (§ 1798.120(c)).

Non-discrimination policy for consumers exercising their rights (§ 1798.125).

1. How often does the Privacy Policy need to be updated under the CCPA/CPRA?
At least once every 12 months, under § 1798.130(a)(5). This goes beyond updating only when there are material changes. The business needs a mandatory annual review process, and the lists of categories sold, shared, and disclosed in the preceding 12 months must be regularly updated.

2. What is the "12-month lookback" and how does it affect the Privacy Policy?
§ 1798.130(a)(2)(B) requires that the response to a consumer access request cover the 12 months preceding receipt of the request. The Privacy Policy must mention this period so the consumer understands which time window is covered by their request.

3. Does the Privacy Policy need to mention the CCPA private right of action?
Yes. § 1798.150 grants consumers the right to file civil lawsuits for security data breaches. The Policy must mention this right and the process: the consumer must provide written notice to the business 30 days in advance before initiating action for statutory damages.

4. Is the toll-free telephone number really mandatory?
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address.

5. What did the CPRA add that was not in the original CCPA?
The CPRA added: the right to correct inaccurate data (§ 1798.106), the right to limit use of sensitive personal information (§ 1798.121), the mandatory "Limit the Use of My Sensitive Personal Information" link, the distinction between "sale" and "sharing" for behavioral advertising, the expanded definition of sensitive personal information (including neural data), and data minimization and proportionate retention requirements. All of this must be reflected in the Privacy Policy.

Ready to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.