Match each processing practice to the privacy policy, , sale-or-sharing opt-out, sensitive-information limit, financial-incentive, or automated decisionmaking technology () notice it requires.
Check each notice’s trigger, required timing, content, placement, language, accessibility, and working rights links before the related processing begins.
Every covered business needs a privacy policy. Additional notices depend on the practice: a for a business that controls collection, an opt-out notice for sale or sharing, a limit notice for sensitive-personal-information uses outside the allowed purposes, a financial-incentive notice for an incentive or price or service difference, and a pre-use notice for covered automated decisionmaking technology (). Each notice has its own trigger and timing.
Under section 7010, every covered business must provide a privacy policy; a business that controls collection must provide a ; a business that sells or shares personal information must provide the applicable opt-out notice and method; a business that uses or discloses sensitive personal information beyond the allowed purposes must provide the applicable limit notice and method; and a business offering a financial incentive or price or service difference must provide a . The regulations effective January 1, 2026 also add a pre-use notice for covered , with Article 11 compliance for significant-decision uses beginning January 1, 2027.
The must be given at or before the point of collection and must tell consumers what categories of personal information will be collected, the purposes for collection and use, whether the information is sold or shared, the retention period or retention criteria, and where to find the privacy policy. The privacy policy must describe the business's online and offline information practices, the categories of personal information collected in the preceding 12 months, the categories of sources and third parties, the business purposes for collection, sale, sharing, and disclosure, the consumer rights available under the CCPA, and the methods for submitting requests.
Sources (2)
CPPA regulations source for privacy policies, notice-at-collection timing and content, sale-or-sharing and limit notices, and financial-incentive disclosures.
Except as set forth in section 7025, subsection (g), a business that sells or shares personal information shall provide a Notice of Right to Opt-out of Sale/Sharing or the Alternative Opt-out Link in accordance with the CCPA and sections 7013 and 7015.
Sections 7010 and 7220 establish the current ADMT pre-use-notice trigger, required timing, linked rights, and content.
Privacy or legal should own the notice standard and approve legal classifications. Product and channel owners should maintain collection-point placement. Data governance should supply categories, purposes, retention, and recipients. Engineering and operations should connect each notice to working rights controls.
Keep a notice register with owner, audience, legal trigger, required delivery time, channel, approved version, publication location, effective date, linked control, source inventory, accessibility and language review, and next review trigger.
Sources (1)
Current consolidated regulation text for privacy policies, collection notices, opt-out and limit notices, financial incentives, and ADMT pre-use notices.
A privacy policy does not replace a timely . A cookie banner does not replace the full sale-or-sharing opt-out method. A contract label does not remove the need to disclose a recipient when the actual data flow makes it a third party.
The notices must be easy to read and understand, available in the languages in which the business ordinarily provides consumer information, reasonably accessible to consumers with disabilities, and presented without dark patterns.
Sources (1)
CPPA regulations source for notice-at-collection timing, content, and placement requirements that support CCPA privacy notices and disclosure workflows.
A business shall not collect categories of personal information other than those disclosed in the notice at collection.
For each change, identify the affected collection point, category, purpose, recipient, retention rule, consumer right, and notice. Update the notice and linked control in the same release rather than treating copy as a later documentation task.
Run a periodic reconciliation and an event-driven review after new products, vendors, data uses, incentives, advertising flows, sensitive-information uses, or deployments.
Sources (1)
CPPA regulations source for notice-at-collection timing, content, and placement requirements that support CCPA privacy notices and disclosure workflows.
A business shall not collect categories of personal information other than those disclosed in the notice at collection.
Map each practice to its required notice, delivery time, linked rights control, owner, approved version, and production test.
Turn Privacy Notices and Disclosures into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Except as set forth in section 7025, subsection (g), a business that sells or shares personal information shall provide a Notice of Right to Opt-out of Sale/Sharing or the Alternative Opt-out Link in accordance with the CCPA and sections 7013 and 7015."
"A business shall not collect categories of personal information other than those disclosed in the notice at collection."
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.