Search every question across sub-FAQs

A privacy policy is an overview, not a substitute for a notice at collection. The business must give the collection notice at or before collection, and it must provide a new notice when it plans to collect an additional category or use personal information for an incompatible additional purpose.

Other recurring errors include copying broad category lists that do not match the data inventory, describing purposes in generic terms, omitting offline practices, treating a service-provider disclosure as automatically outside sale or sharing without checking the contract and actual use, and claiming not to sell or share while the product or advertising stack behaves differently.

Execute the contract before disclosing personal information. It must prohibit sale or sharing; identify each specific business purpose; prohibit retaining, using, or disclosing the data outside those purposes, for an unpermitted commercial purpose, or outside the direct business relationship; and address impermissible combining of data from other sources. A reference to the agreement as a whole is not specific enough.

The contract must require compliance with applicable CCPA provisions and the same level of privacy protection required of businesses. It must enable the business to handle consumer requests, allow reasonable and appropriate oversight, require notice if the vendor can no longer meet its obligations, and let the business stop and remediate unauthorized use. A service provider or contractor that engages a subcontractor must impose a downstream contract that complies with the CCPA and section 7051.

A person without a compliant section 7051 contract is not a service provider or contractor under the CCPA. The disclosure may then be a sale or sharing that requires consumer opt-out rights, depending on the facts. Even with compliant text, processing outside the permitted purposes or relationship can defeat the intended role.

The roles are close but not identical. A service provider processes personal information on behalf of the business and receives it from or for the business; a contractor is a person to whom the business makes personal information available for a business purpose. Both need the statutory written restrictions and section 7051 terms. A third party has a different contract under section 7053, and sale or sharing analysis applies to the transfer.

Section 7050 permits limited uses when they remain reasonably necessary and proportionate, including the contract's specific purposes, compliant subcontracting, internal work to build or improve the quality of the service without using the original data to serve another person, and other listed operational purposes. It does not authorize the vendor to repurpose customer data for its own advertising, unrelated products, or another customer's services.

Keep a role assessment for each vendor, the signed agreement and amendments, the specific-purpose schedule, data-flow record, security review, subcontractor list, and evidence that the vendor can support consumer requests. Record which systems and personal-information categories are in scope and which vendor uses are prohibited.

Use the contract's oversight rights and keep evidence. Preserve due-diligence results, audit or test reports, issue notices, remediation evidence, deletion confirmations, and any notice that the vendor can no longer meet its obligations. Section 7051 says reasonable steps may include manual reviews, automated scans, assessments, audits, or other technical and operational testing; the appropriate method depends on the relationship and risk.

A data-protection addendum does not prove service-provider or contractor status. Reassess the role when the vendor adds a product feature, combines customer data, uses data for its own advertising or model training, changes retention, or adds a subcontractor.

A business that never enforces the contract or exercises its audit and testing rights may have difficulty relying on the statutory defense that it had no reason to believe the vendor intended to violate the CCPA. Record the review cadence and follow through on identified misuse.

Start by classifying the right. For a password-protected account, the regulations generally allow verification through the business's existing authentication practices, but the business must reauthenticate the consumer before deleting or correcting data or disclosing the requested data. It must also use reasonable security safeguards.

For a non-accountholder, match data supplied by the consumer against reliable information the business already maintains. A request for categories of personal information requires a reasonable degree of certainty; a request for specific pieces or access to ADMT requires a reasonably high degree of certainty. A deletion or correction request uses the assurance level appropriate to the sensitivity of the information and risk of harm from unauthorized action.

Keep enough evidence to reproduce why a request passed, failed, or was handled at a particular assurance level without retaining unnecessary identity documents.

Verification should reduce impersonation risk without turning the request process into a new source of sensitive personal information.

A business must conduct a risk assessment before selling or sharing personal information; processing sensitive personal information; using automated decisionmaking technology (ADMT) for a significant decision; carrying out specified systematic-observation or sensitive-location profiling; or processing personal information to train specified ADMT, facial-recognition, emotion-recognition, identity-verification, or physical or biological identification or profiling technology. A narrow exception covers sensitive personal information processed solely for listed employment-administration purposes.

A cybersecurity audit is required if the business derived at least 50 percent of its annual revenue from selling or sharing consumers' personal information in the preceding year. It is also required when the business meets the CCPA revenue threshold and, in the preceding year, processed either the personal information of at least 250,000 consumers or households or the sensitive personal information of at least 50,000 consumers.

The first audit report is due April 1, 2028 for a qualifying business with more than $100 million in 2026 annual gross revenue; April 1, 2029 for a qualifying business with 2027 revenue between $50 million and $100 million; or April 1, 2030 for a qualifying business with 2028 revenue below $50 million. The regulations specify a one-year audit period for each phase. After April 1, 2030, a business that meets section 7120 on January 1 based on the preceding year must audit the next 12 months and complete its report by April 1 of the following year.

Processing started before January 1, 2026 and continuing after that date must have its risk assessment documented by December 31, 2027. Information for assessments conducted in 2026 and 2027 is due to the Agency by April 1, 2028; later submissions are due by April 1 following a year in which assessments were conducted. The routine submission is specified information and an executive attestation, not the full assessment report.

For a cybersecurity audit, keep the scope, criteria, evidence examined, testing and sampling, findings, gaps, remediation plan and dates, auditor qualifications, signed auditor statement, and any required breach-notification material. The business and auditor must retain all documents relevant to each audit for at least five years after completion.

For a risk assessment, preserve the specific processing purpose, data categories and minimum necessary data, sources, retention, affected consumers, technology and participants, benefits, negative impacts, safeguards, residual risks, and the decision-maker's name and position. Keep original and updated versions for as long as the processing continues or five years after completion, whichever is later.

The Agency receives a cybersecurity-audit completion certification, not the full audit report as the routine annual filing. Risk-assessment submissions contain the information listed in section 7157, including counts, categories, and an executive attestation; the Agency or Attorney General may separately demand the assessment reports, which must then be provided within 30 calendar days.

Do not combine the two threshold tests. High-risk privacy processing can require a risk assessment even when the business does not meet the cybersecurity-audit thresholds. Conversely, a business subject to annual audits must still test each activity separately under section 7150.

The auditor may be internal or external, but must use objective and impartial judgment, be free to report findings without influence, and not rely primarily on management assertions. A risk assessment must be reviewed at least once every three years and updated as soon as feasibly possible, no later than 45 calendar days after a material change that creates or increases negative impacts or weakens safeguards.