Search every question across sub-FAQs

First determine whether the business sells or shares the minor's personal information and what facts give the business actual knowledge of age. Do not collect extra age or identity data without a defined need, but do not ignore account records, birth dates, product design, support contacts, or other facts already known to the business.

For a consumer under 13, establish, document, and use a reasonable method to determine that the person authorizing is the parent or guardian. Section 7070 examples include a signed consent form, a payment method that notifies the primary account holder, a staffed toll-free call, videoconference or in-person verification, and a government-ID check followed by prompt deletion of the identification. This CCPA authorization is additional to any verifiable parental consent required by the federal Children's Online Privacy Protection Act.

For ages 13 through 15, establish, document, and use a reasonable process that lets the consumer affirmatively opt in. After either age path produces authorization, tell the parent, guardian, or consumer about the continuing right to opt out and how to exercise it. The privacy policy must describe the applicable processes.

The CCPA's special rule is tied to sale or sharing and actual knowledge, not to every collection of information about a person under 18. Other laws, including the federal Children's Online Privacy Protection Act, may impose separate duties for child-directed services or collection from children under 13.

Keep evidence of the age signal, the applicable age band, the authorization process, and the downstream block. Avoid retaining more identity data than the method reasonably requires.

Using the wrong age band, ignoring facts that establish actual knowledge, or recording consent without changing system behavior breaks the authorization process.

Map every point where the business controls collection, including websites, apps, connected devices, in-person forms, phone calls, cameras, employment processes, and collection through another business's site or premises. Place the notice where the consumer can see it before the collection starts.

List the categories of personal information and sensitive personal information in a way that gives a meaningful understanding of what is collected. For each category, state the collection and use purposes, whether it is sold or shared, and the retention period or the criteria used to determine it. Link the privacy policy and, when applicable, the sale or sharing opt-out notice.

If the business later collects an additional category or uses information for a purpose incompatible with the disclosed purpose, provide the notice or obtain the consent required by the regulations before the new collection or use.

More than one business may control the same collection point. For example, a site operator and a third-party ad network that controls its own collection both owe notice, although they may use one combined notice. Similar rules apply to third-party Wi-Fi on store premises and technology collecting data inside a rental vehicle. Assign each controller and confirm that the combined or separate notices cover its actual practices.

A business that neither collects nor controls collection directly from the consumer need not give this notice when it also neither sells nor shares the information. A registered data broker collecting indirectly has a separate regulatory exception when its registration links to an online privacy policy with sale-and-sharing opt-out instructions. These exceptions do not remove other CCPA disclosures or rights.

Keep evidence for each collection point, not one generic screenshot. The record should connect what the notice said to the data the product or process collected at that time.

A privacy policy can support the notice, but a link in a footer may be too late or too remote for a collection point that starts immediately.

Personal information includes identifiers, customer records, protected characteristics, commercial information, biometric information, internet activity, geolocation, sensory information, employment information, education information, inferences, and sensitive personal information when the linkability test is met. It can exist in physical, digital, compressed, encrypted, metadata, or AI-system formats.

Sensitive personal information includes government identifiers; account credentials that allow access; precise geolocation; racial or ethnic origin; citizenship or immigration status; religious or philosophical beliefs; union membership; contents of communications when the business is not the intended recipient; genetic data; neural data; biometric information processed to uniquely identify a consumer; and collected and analyzed information concerning health, sex life, or sexual orientation.

Some elements are conditional. An account log-in, financial account, debit-card, or credit-card number is sensitive when combined with the security code, password, or credentials that permit account access. Biometric information is sensitive when processed to uniquely identify a consumer. Communication contents have an intended-recipient qualification. Precise geolocation means device-derived data used or intended to locate a consumer within an area no larger than a circle with a radius of 1,850 feet.

Publicly available information, lawfully obtained truthful information of public concern, deidentified information, and aggregate consumer information are outside the personal-information definition when the statutory conditions are met. A public-web label alone is insufficient: the statute identifies government records, information the business reasonably believes the consumer or widely distributed media lawfully made public, and information disclosed to another person without restriction to a specific audience. Biometric information collected without the consumer's knowledge is not publicly available.

Classification does not decide every downstream right by itself. A business must disclose sensitive categories in notices and assess applicable security and risk duties, but the right to limit applies only to uses or disclosures outside the purposes allowed by Civil Code section 1798.121 and section 7027. For example, proportionate use to perform a requested service, resist fraud, protect physical safety, or verify identity may fall within a listed purpose.

Keep the classification rationale close to the data inventory. A label such as "location" or "biometric" is too broad to show whether the statutory sensitive-information condition is met.

Category mistakes spread into notices, request searches, retention, vendor controls, and risk analysis. Classify from the statutory test and the actual processing.

The primary definition covers a for-profit legal entity that collects consumers' personal information, or has it collected on its behalf; alone or jointly determines the purposes and means of processing; does business in California; and meets at least one threshold. Nonprofits and government agencies generally fall outside this definition, but labels and tax status do not replace analysis of the entity and its role.

The three tests are: gross annual revenue in excess of $26,625,000 for the preceding calendar year, effective January 1, 2025; annually buying, selling, or sharing the personal information of at least 100,000 consumers or households, alone or in combination; or deriving at least 50 percent of annual revenue from selling or sharing consumers' personal information. For the volume test, count distinct consumers or households covered by the statutory activity, not database rows, devices, events, or transactions. The CPPA adjusts the monetary threshold on January 1 of each odd-numbered year, so confirm the official amount before using it for 2027 or a later year.

Coverage can also reach an entity that controls or is controlled by a threshold business, shares common branding with it, and shares consumers' personal information with it. A joint venture or partnership composed of businesses in which each has at least a 40 percent interest is separately treated as a business. A person doing business in California may also voluntarily certify to the CPPA that it will comply and be bound.

For the controlled-entity route, control means more than 50 percent of voting securities, control over election of a majority of directors or equivalent functions, or power to exercise a controlling influence over management. Common branding means a shared name, service mark, or trademark that an average consumer would understand as common ownership. All three route-specific facts, including intercompany sharing of consumers' personal information, need evidence.

After finding coverage, test statutory exemptions and data-specific carve-outs separately. Also classify recipients as service providers, contractors, or third parties. Those roles carry obligations even though they are not established by the three primary business thresholds. Reassess at least annually, using the preceding calendar year for the gross-revenue threshold, and sooner after acquisitions, divestitures, major growth, new data brokerage or advertising activity, or changed affiliate data flows.

Keep a dated applicability memo for each legal entity. It should show the preceding-year gross revenue, the method used to count consumers and households whose information was bought, sold, or shared, and the calculation of revenue derived from sale or sharing. Reconcile the figures to finance records, data maps, contracts, and advertising or data-transfer systems.

Document the nonnumeric tests as carefully as the thresholds: California business activity, profit status, purposes-and-means decision authority, ownership and control, common branding, intercompany sharing, joint-venture interests, voluntary certification, and service-provider or contractor roles. Record any exemption by the covered data and processing, not as a blanket conclusion unless the law supports an entity-wide exclusion.

Do not stop after one failed threshold. The tests are alternatives, and the controlled-entity, joint-venture, and voluntary routes are separate. Recalculate after acquisitions, divestitures, changes in intercompany data sharing, new advertising practices, or material growth.

Do not count every record as a separate consumer, omit households, or limit the volume test to information sold. The statute includes personal information bought, sold, or shared. Likewise, revenue from sharing counts in the 50-percent test.

Describe the categories of personal information collected in the preceding 12 months, the categories of sources, and the specific business or commercial purposes for collection. Separately identify the categories sold or shared, the relevant categories of third parties, and the purposes for sale or sharing. Also identify the categories disclosed to a service provider or contractor for a business purpose and explain that purpose. State when no sale, sharing, or business-purpose disclosure occurred instead of leaving the category unanswered.

Explain the rights to know, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and be free from retaliation for exercising CCPA rights. If the business uses ADMT for a significant decision under section 7200, explain the applicable rights to opt out of and access that ADMT no later than January 1, 2027. Give the actual request methods, verification overview, authorized-agent instructions, contact method, and the links or notice content required for sale or sharing and sensitive-personal-information choices. If the business processes opt-out preference signals, explain how a signal applies to the browser, device, account, or offline activity.

Post the policy through a conspicuous link using the word "privacy" on each website homepage and on a mobile application's download or landing page. A mobile app must also link to the policy from its settings. A business without a website must make the policy conspicuously available. The policy must be printable, accessible, understandable, available in the languages ordinarily used for business communications, and dated with its last update.

The policy must also state whether the business has actual knowledge that it sells or shares personal information of consumers under 16 and, when that condition applies, describe the under-13 and age-13-to-15 authorization processes. It must state whether sensitive personal information is used or disclosed outside section 7027's listed purposes. If section 7102's reporting threshold applies, include the required request metrics or link to them.

Keep the published policy and the records that support each statement. Connect each version to the data inventory, collection notices, system behavior, vendor roles, request workflow, and approval history.

Retain dated copies or screenshots showing where the policy and privacy-choice links appeared, test results for web and mobile request methods, and evidence showing how opt-out preference signals were processed. Record the owner, approval date, last-updated date, 12-month lookback period, next review date, and the change that would trigger an earlier review.