What content and placement does each collection point need?
Map every point where the business controls collection, including websites, apps, connected devices, in-person forms, phone calls, cameras, employment processes, and collection through another business's site or premises. Place the notice where the consumer can see it before the collection starts.
List the categories of personal information and sensitive personal information in a way that gives a meaningful understanding of what is collected. For each category, state the collection and use purposes, whether it is sold or shared, and the retention period or the criteria used to determine it. Link the privacy policy and, when applicable, the sale or sharing opt-out notice.
If the business later collects an additional category or uses information for a purpose incompatible with the disclosed purpose, provide the notice or obtain the consent required by the regulations before the new collection or use.
More than one business may control the same collection point. For example, a site operator and a third-party ad network that controls its own collection both owe notice, although they may use one combined notice. Similar rules apply to third-party Wi-Fi on store premises and technology collecting data inside a rental vehicle. Assign each controller and confirm that the combined or separate notices cover its actual practices.
A business that neither collects nor controls collection directly from the consumer need not give this notice when it also neither sells nor shares the information. A registered data broker collecting indirectly has a separate regulatory exception when its registration links to an online privacy policy with sale-and-sharing opt-out instructions. These exceptions do not remove other CCPA disclosures or rights.
- Identify who controls each collection point and who must provide the notice.
- Place a just-in-time link or notice where the consumer encounters it before collection.
- Match categories and purposes to the actual fields, sensors, tags, software development kits (SDKs), forms, and inferred data.
- State retention by category or give usable criteria; avoid an open-ended statement with no decision rule.
- Block launches and later data changes until the notice and collection behavior match.
When must a CCPA appear?
It must be readily available where the consumer will encounter it at or before the point of collection. If the business does not give the notice on time, section 7012 says it must not collect personal information from that consumer. The timing applies to passive collection such as tags, SDKs, sensors, and observation as well as information typed into a form.
What must a CCPA include?
List the categories of personal information and sensitive personal information to be collected; the purposes for collecting and using each category; whether each category is sold or shared; the retention period for each category or the criteria used to set it; the sale-and-sharing opt-out notice link when applicable; and a link to the privacy policy.
Can a privacy policy serve as the ?
Online, the business may link directly to the specific privacy-policy section containing every required notice element. A link to the beginning of the policy, or to a different section that makes the consumer scroll to find the categories or sale-and-sharing status, does not satisfy section 7012.
How should a business give notice offline or through a device?
Match the channel. Printed forms may carry the notice; a store may use prominent signage; phone or in-person collection may use an oral notice; an app may place a link on its download page and in the app; and a connected device must present notice before or when collection begins. Keep evidence that the consumer encounters the notice in the actual collection path.
Who gives notice when a third party controls collection?
Each business that controls the collection has a notice duty. A first party and third party may provide one combined notice covering both sets of practices, or separate notices. The rule applies when a third party controls collection through another business's website or physical premises, including examples such as ad networks, store Wi-Fi, and technology inside rental vehicles.
When does indirect collection avoid a ?
A business that neither collects nor controls collection directly from the consumer does not need this notice if it also neither sells nor shares the information. A registered data broker collecting from another source has a separate exception when its registration links to an online privacy policy containing sale-and-sharing opt-out instructions. Apply the exception narrowly and keep the supporting facts.
Citations (2)
- California Consumer Privacy Act Regulations - Notice at Collection
Section 7012 sets timing, placement, required content, third-party collection, and change controls.
- California Civil Code section 1798.100
Binding notice, purpose limitation, compatibility, and retention requirements.