Privacy Notices and Disclosures under the US CCPA means giving people the required notices at collection and in the privacy policy, plus any opt-out, limit, financial incentive, or ADMT disclosures that apply.
This guide turns the CCPA notice rules into operational checks for timing, content, placement, and evidence, based on the California Privacy Protection Agency regulations and updated with the official source text before implementation.
Structured answer sets in this page tree.
Cited legal and guidance references.
Every covered business needs a privacy policy. Additional notices depend on the practice: a for a business that controls collection, an opt-out notice for sale or sharing, a limit notice for sensitive-personal-information uses outside the allowed purposes, a financial-incentive notice for an incentive or price or service difference, and a pre-use notice for covered automated decisionmaking technology (). Each notice has its own trigger and timing.
Under section 7010, every covered business must provide a privacy policy; a business that controls collection must provide a ; a business that sells or shares personal information must provide the applicable opt-out notice and method; a business that uses or discloses sensitive personal information beyond the allowed purposes must provide the applicable limit notice and method; and a business offering a financial incentive or price or service difference must provide a . The regulations effective January 1, 2026 also add a pre-use notice for covered , with Article 11 compliance for significant-decision uses beginning January 1, 2027.
The must be given at or before the point of collection and must tell consumers what categories of personal information will be collected, the purposes for collection and use, whether the information is sold or shared, the retention period or retention criteria, and where to find the privacy policy. The privacy policy must describe the business's online and offline information practices, the categories of personal information collected in the preceding 12 months, the categories of sources and third parties, the business purposes for collection, sale, sharing, and disclosure, the consumer rights available under the CCPA, and the methods for submitting requests.
Privacy or legal should own the notice standard and approve legal classifications. Product and channel owners should maintain collection-point placement. Data governance should supply categories, purposes, retention, and recipients. Engineering and operations should connect each notice to working rights controls.
Keep a notice register with owner, audience, legal trigger, required delivery time, channel, approved version, publication location, effective date, linked control, source inventory, accessibility and language review, and next review trigger.
A privacy policy does not replace a timely . A cookie banner does not replace the full sale-or-sharing opt-out method. A contract label does not remove the need to disclose a recipient when the actual data flow makes it a third party.
The notices must be easy to read and understand, available in the languages in which the business ordinarily provides consumer information, reasonably accessible to consumers with disabilities, and presented without dark patterns.
For each change, identify the affected collection point, category, purpose, recipient, retention rule, consumer right, and notice. Update the notice and linked control in the same release rather than treating copy as a later documentation task.
Run a periodic reconciliation and an event-driven review after new products, vendors, data uses, incentives, advertising flows, sensitive-information uses, or deployments.
This US CCPA guide turns Privacy Notices and Disclosures into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Privacy Notices and Disclosures into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Except as set forth in section 7025, subsection (g), a business that sells or shares personal information shall provide a Notice of Right to Opt-out of Sale/Sharing or the Alternative Opt-out Link in accordance with the CCPA and sections 7013 and 7015."
"On March 29, 2023, the Office of Administrative Law approved the California Privacy Protection Agency’s regulations and filed"
"A business shall not collect categories of personal information other than those disclosed in the notice at collection."