Build the annual CCPA privacy policy from actual online and offline practices, required category disclosures, consumer rights and methods, sale or sharing and sensitive-PI choices, retention, and the policy last-updated date.
Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.
Structured answer sets in this page tree.
Cited legal and guidance references.
Every covered business must maintain a CCPA privacy policy that gives consumers a comprehensive account of its online and offline information practices, the of category-level collection and disclosures, applicable rights, request methods, and a contact. The policy is a lookback and rights guide; it does not replace the Notice at Collection required before new collection.
A covered business needs a policy that accurately describes its online and offline practices. Draft it from the data inventory and rights workflow, then organize it so a consumer can find categories, purposes, recipients, rights, and request methods without reconstructing the business's operations. The policy must be printable and conspicuously available; a mobile application must link to it from both the download or landing page and the app's settings menu.
For Privacy Policy content specifically, the policy should say what categories of personal information the business collected in the , where the information came from, why it was collected or sold or shared, whether it was sold or shared, whether it was disclosed for a business purpose, which categories of third parties received it, whether the business uses sensitive personal information for purposes other than those allowed by section 7027, and how consumers can exercise the right to know, delete, correct, opt out, or limit.
Privacy should own the policy; data governance should maintain category, source, purpose, retention, and recipient facts; product and marketing should confirm current collection and advertising practices; procurement should confirm vendor roles; and support should verify request methods.
Keep the approved policy, data-map extract, recipient and contract review, rights-flow tests, publication capture, prior version, change log, accessibility evidence, language review, and annual-review approval.
The preceding-12-month disclosures are a lookback, not permission for the next 12 months. A Notice at Collection still must precede new collection, and a materially different use may require a new notice and, in some circumstances, explicit consent.
Use recipient categories that give a meaningful understanding of who receives the information. Do not rely on labels such as 'partners' or 'trusted providers' when the business can describe advertising networks, analytics providers, operating systems, social networks, data brokers, or other relevant groups.
Reconcile the policy against the current inventory, notice-at-collection set, opt-out and limit controls, vendor map, financial incentives, minors procedures, rights methods, and request metrics. Resolve discrepancies in the underlying practice as well as the text.
Publish the updated policy with a new last-updated date only after the review is complete. Keep prior versions so the business can show what it told consumers during an earlier period.
This US CCPA guide turns Privacy Policy into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Privacy Policy into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"The purpose of the privacy policy is to provide consumers with a comprehensive description of a business’s online and offline information practices."