Artifact GuideUSNotice at collection

US CCPA Notice at collection

Give a readily available notice at or before collection that identifies the categories collected, purposes, sale or sharing status, retention period or criteria, and a link to the privacy policy.

Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

A must tell consumers, at or before collection, what categories of personal information the business will collect, what purposes it will use them for, whether each category is sold or shared, how long each category will be retained or how that period is set, and where the privacy policy and applicable opt-out notice can be found. If the business does not give the notice on time, it must not collect the personal information.

Section 1

What should teams decide about Notice at collection under the US CCPA?

Start by deciding whether the business is collecting personal information from consumers and must give the at or before the point of collection. The notice must identify the categories of personal information to be collected, the purposes for which the information is collected and used, whether each category is sold or shared, the retention period or retention criteria, and the link to the privacy policy and, if applicable, the opt-out notice.

The consumer must encounter the notice before or at the collection point. For online collection, use a conspicuous link on the page or screen where collection occurs, or a link that opens the exact privacy-policy section containing all required notice information; sending the consumer to the top of a policy that must then be searched or scrolled does not satisfy the rule. For offline collection, the regulations allow methods such as paper, prominent signage that points to the notice, or oral delivery when information is collected by phone or in person.

Inventory every field, sensor, cookie, SDK, pixel, log, recording, and third-party collection mechanism active at the collection point.
Use CCPA categories, but describe them specifically enough that a consumer can understand what the business collects.
State the purpose for each category, whether it is sold or shared, and the retention period or the criteria used to determine it.
Include a privacy-policy link and, when applicable, the notice or link for sale or sharing and sensitive-personal-information limits.

Sources for this answer

California CCPA statute and regulations effective January 1, 2026

Official CPPA text for the notice-at-collection duty, including timing at or before collection and required disclosure categories.

California Consumer Privacy Act Regulations (March 2023)

CPPA regulations page used to confirm the approved CCPA regulations and link implementation teams to the official rule text.

Section 2

Who should own Notice at collection, and what evidence should prove the decision?

The product or channel owner should maintain the collection-point inventory and placement; privacy or legal should approve category, purpose, sale or sharing, and retention statements; engineering or operations should ensure that collection cannot precede the notice.

Keep the approved copy, inventory, screen or location captures, accessibility review, release record, tag or SDK configuration, and tests showing what loads before and after the notice.

Test first visit, return visit, logged-in and logged-out states, mobile and desktop, and each offline script or sign.
Match every disclosed category and purpose to the current data inventory and retention schedule.
Verify that links open directly to the promised notice or policy section and remain usable with assistive technology.
Assign a release blocker for new collection that is absent from the approved notice.

Sources for this answer

California CCPA statute and regulations effective January 1, 2026

Official CPPA text for the notice-at-collection duty, including timing at or before collection and required disclosure categories.

California Consumer Privacy Act Regulations (March 2023)

CPPA regulations page used to confirm the approved CCPA regulations and link implementation teams to the official rule text.

CPPA enforcement advisory on dark patterns

CPPA advisory used for notice and choice design quality, especially clear language and symmetry in consumer controls.

Section 3

Which edge cases should teams check before relying on a Notice at collection decision?

More than one business may control collection at the same point. A first party and a third party ad network that controls collection through the first party's site can each owe a notice. They may use one combined notice only if it accurately covers their collective practices. The same analysis applies to third-party collection on physical premises, such as a Wi-Fi provider in a shop or a technology provider collecting data inside a rental vehicle.

A business cannot collect an additional category or use collected personal information for a without giving a new notice. If the new purpose is incompatible with the disclosed context, the regulations may also require explicit consent.

Do not bury the notice behind a generic footer link when the consumer would not see it at the collection point.
Do not describe only information typed into a form if cookies, pixels, device data, audio, video, or location are also collected.
Do not state 'as long as necessary' without identifying meaningful retention criteria.
Do not assume the first party's notice covers a third party whose collection or purposes are not disclosed.
Document any indirect-collection exception. A business that neither collects nor controls collection directly from the consumer may omit this notice only if it also neither sells nor shares the information; a registered data broker has a separate, conditional registration-based rule.

Sources for this answer

California CCPA statute and regulations effective January 1, 2026

Official CPPA text for the notice-at-collection duty, including timing at or before collection and required disclosure categories.

California Consumer Privacy Act Regulations (March 2023)

CPPA regulations page used to confirm the approved CCPA regulations and link implementation teams to the official rule text.

CPPA enforcement advisory on dark patterns

CPPA advisory used for notice and choice design quality, especially clear language and symmetry in consumer controls.

Section 4

How should teams operationalize Notice at collection with proportionate controls?

Review the notice as part of release approval for any form, account flow, store process, phone script, connected device, cookie, pixel, SDK, or sensor. Compare the production data flow with the approved inventory before launch.

When collection changes, update the notice before the new collection begins and keep a dated record linking the release, notice version, and inventory change.

Identify who controls collection, what is collected, when collection starts, and every online or offline collection point.
Map categories to purposes, sale or sharing status, and retention periods or criteria.
Publish the notice at or before collection with the required links and accessible presentation.
Test production behavior and block undisclosed collection or materially different use.

Sources for this answer

California CCPA statute and regulations effective January 1, 2026

Official CPPA text for the notice-at-collection duty, including timing at or before collection and required disclosure categories.

California Consumer Privacy Act Regulations (March 2023)

CPPA regulations page used to confirm the approved CCPA regulations and link implementation teams to the official rule text.

Recommended next step