US CCPA CCPA Privacy Policy Template

For the preceding 12 months, identify each statutory category of personal information collected and describe representative data elements meaningfully. State the categories of sources and the specific business or commercial purposes for collection or use. For example, "email address from the consumer to send an order confirmation" is more useful than "contact information to improve services." The business must derive these statements from its actual online and offline practices.

Identify each category sold or shared, the categories of third parties receiving it, and the specific purpose. If none was sold or shared, say so. Separately identify categories disclosed to service providers or contractors for a business purpose and the purpose of those disclosures. State whether the business uses or discloses sensitive personal information outside the purposes listed in section 7027(m), and whether it has actual knowledge that it sells or shares personal information of consumers under 16.

Keep the statutory categories distinct from the examples that make them understandable. A category such as internet or other electronic network activity may include browsing history, search history, and interactions with a site, application, or advertisement; the policy should name the elements the business actually handles without implying that every statutory example is collected.

Explain each right that applies to the business's practices: know, delete, correct, opt out of sale or sharing, limit certain sensitive-personal-information use or disclosure, applicable ADMT access and opt-out rights, and freedom from retaliation. The ADMT rights apply to covered uses for significant decisions, with compliance required from January 1, 2027. State the conditions and common exceptions instead of implying that every request always produces the requested outcome.

Provide the actual submission methods and direct links to forms or portals. A business must offer methods that fit how it interacts with consumers; the regulations generally require two or more methods for delete, correct, and know requests, subject to the online-only direct-relationship rule. Describe verification for know, delete, correct, and ADMT access requests, and give authorized agents usable instructions.

Explain how an opt-out preference signal applies to the browser or device and associated profiles, and to the consumer when known. If optional information is needed to extend the choice to otherwise unmatched offline sale or sharing, say that providing it is optional and honor the browser or device scope immediately.

Post the policy online through a conspicuous homepage link using the word "privacy." A mobile application must also link to it from the settings menu. A business without a website must make it conspicuously available, and the policy must be printable. These placement rules do not replace the separate notice at collection, opt-out notice, limit notice, or financial-incentive notice when those apply.

Review the policy against the live inventory and controls at least once every 12 months and before a new or changed practice makes the published description inaccurate. Check collection points, SDKs, tags, data recipients, contracts, rights portals, GPC behavior, sensitive-information uses, minors, financial incentives, and ADMT. A notice at collection must be updated before collecting an additional category or using information for an incompatible purpose; changing the annual policy later does not cure a missing point-of-collection notice.

The policy owner should reconcile each disclosure to evidence: inventory records for categories and purposes, recipient and contract records for sale, sharing, and business-purpose disclosures, interface and network tests for request and signal behavior, and publication records for placement and date. Update the visible last-updated date only when the policy text changes.