US CCPA Privacy Policy

Start by deciding whether the issue affects business-threshold status, notice at collection, Privacy Policy disclosures, consumer rights, do-not-sell/share controls, GPC, service-provider restrictions, or enforcement exposure. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

For Privacy Policy content specifically, the policy should say what categories of personal information the business collected in the preceding 12 months, where the information came from, why it was collected or sold or shared, whether it was sold or shared, whether it was disclosed for a business purpose, which categories of third parties received it, whether the business uses sensitive personal information for purposes other than those allowed by section 7027, and how consumers can exercise the right to know, delete, correct, opt out, or limit.

Ownership should sit with the team that can change notices, request intake, ad-tech settings, vendor contracts, data retention, or consumer-facing controls, with privacy/legal review for ambiguous cases.

Evidence should show threshold calculations, notice-at-collection placement, privacy-policy disclosures, rights request logs, opt-out/GPC handling, vendor restrictions, and enforcement-response readiness.

Most CCPA mistakes happen at the boundary between a business, service provider, contractor and third party, or between selling, sharing, financial incentives, minors, GPC, and data-broker obligations.

Apply this section before launching a collection point, ad-tech flow, rights workflow, vendor onboarding, financial incentive, minor-focused journey, or data-broker process. If the business subject to section 7011 also has a California-specific privacy-rights description, the privacy policy must be included in that description, and mobile-app policies must remain accessible through the download page or settings menu.

Use a CCPA workflow that captures threshold status, data category, collection point, consumer right, opt-out or GPC trigger, vendor role, evidence, owner, and review date.

The output should be a threshold note, notice update, DSAR decision, opt-out/GPC record, vendor clause map, dark-pattern review, or enforcement evidence pack. For the privacy policy itself, make sure the text tells consumers what information is collected, sold, shared, or disclosed, what rights they have, how to submit requests, and where to find the policy in a form that is easy to read and accessible.