US CCPA Privacy Policy

A covered business needs a policy that accurately describes its online and offline practices. Draft it from the data inventory and rights workflow, then organize it so a consumer can find categories, purposes, recipients, rights, and request methods without reconstructing the business's operations. The policy must be printable and conspicuously available; a mobile application must link to it from both the download or landing page and the app's settings menu.

The policy must say what categories of personal information the business collected in the preceding 12 months, where the information came from, why it was collected or sold or shared, whether it was sold or shared, whether it was disclosed for a business purpose, which categories of third parties received it, whether the business uses sensitive personal information for purposes other than those allowed by section 7027, and how consumers can exercise the right to know, delete, correct, opt out, or limit.

Privacy should own the policy; data governance should maintain category, source, purpose, retention, and recipient facts; product and marketing should confirm current collection and advertising practices; procurement should confirm vendor roles; and support should verify request methods.

Keep the approved policy, data-map extract, recipient and contract review, rights-flow tests, publication capture, prior version, change log, accessibility evidence, language review, and annual-review approval.

The preceding-12-month disclosures are a lookback, not permission for the next 12 months. A Notice at Collection still must precede new collection, and a materially different use may require a new notice and, in some circumstances, explicit consent.

Use recipient categories that give a meaningful understanding of who receives the information. Do not rely on labels such as 'partners' or 'trusted providers' when the business can describe advertising networks, analytics providers, operating systems, social networks, data brokers, or other relevant groups.

Reconcile the policy against the current inventory, notice-at-collection set, opt-out and limit controls, vendor map, financial incentives, minors procedures, rights methods, and request metrics. Resolve discrepancies in the underlying practice as well as the text.

Publish the updated policy with a new last-updated date only after the review is complete. Keep prior versions so the business can show what it told consumers during an earlier period.