California CCPA/CPRA Privacy Notice
CALIFORNIA CCPA/CPRA PRIVACY NOTICE
Last updated: [MONTH DAY, YEAR]
This notice describes how [COMPANY LEGAL NAME] (“we,” “us,” or “our”) collects, uses, retains, discloses, sells, or shares personal information and how California consumers may exercise applicable rights.
Publication gate: Do not publish until the applicability record, data map, twelve-month lookback, notice-at-collection inventory, sale/share analysis, sensitive-information analysis, request workflow, vendor contracts, minors analysis, and ADMT analysis below are complete and approved.
1. Business Identity, Scope, and Applicability Record
Legal name: [________________________________]
Brands and controlled affiliates covered by this notice: [________________________________]
Website and mobile applications: [________________________________]
Primary consumer-contact method: [________________________________]
Policy contact: [________________________________]
1.1 CCPA Business Gate
Complete before using this notice:
| Applicability fact | Verified result | Evidence and review date |
|---|---|---|
| Organized or operated for profit or financial benefit | ☐ Yes ☐ No ☐ Review | [________________] |
| Does business in California | ☐ Yes ☐ No ☐ Review | [________________] |
| Determines purposes and means of processing | ☐ Yes ☐ No ☐ Review | [________________] |
| Preceding-year annual gross revenue exceeds the current $26,625,000 adjusted threshold | ☐ Yes ☐ No ☐ Review | [________________] |
| Annually buys, sells, or shares personal information of 100,000 or more consumers or households | ☐ Yes ☐ No ☐ Review | [________________] |
| Derives 50% or more of annual revenue from selling or sharing consumers' personal information | ☐ Yes ☐ No ☐ Review | [________________] |
| Covered through control, common branding, shared personal information, joint venture, partnership, or voluntary certification | ☐ Yes ☐ No ☐ Review | [________________] |
Approved coverage conclusion: [________________________________]
Entity, data, or activity exclusions and exemptions: [________________________________]
Do not use an unchecked threshold or a general statement that “we value privacy” as a substitute for a current applicability analysis.
1.2 Consumers and Channels Covered
This notice applies to the following California-consumer relationships and collection channels:
☐ website visitors
☐ mobile-app users
☐ customers and prospective customers
☐ business contacts
☐ job applicants, employees, independent contractors, or personnel
☐ students or educational-program applicants
☐ offline visitors, callers, event attendees, or facility visitors
☐ connected devices, vehicles, kiosks, cameras, or sensors
☐ other: [________________________________]
Excluded relationship or channel: [________________________________]
2. Personal Information Practices — Preceding Twelve Months
Complete one row for every current category. “No” must reflect the completed data map, including vendors, pixels, software-development kits, advertising technology, offline records, inferred profiles, personnel data, and third parties that control collection.
| Category | Collected? | Sources | Specific collection/use purposes | Sold or shared? | Third-party recipients | Disclosed to service provider or contractor? | Retention period or criteria |
|---|---|---|---|---|---|---|---|
| A. Identifiers | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| B. California customer-record information incorporated by the CCPA | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| C. Protected-classification characteristics | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| D. Commercial information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| E. Biometric information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| F. Internet or electronic-network activity | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| G. Geolocation data | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| H. Audio, electronic, visual, thermal, olfactory, or similar information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| I. Professional or employment-related information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| J. Education information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| K. Inferences used to create a consumer profile | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| L. Sensitive personal information | ☐ Yes ☐ No | [____] | [____] | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
If no category was sold or shared during the preceding twelve months, state that fact here: [________________________________].
If no category was disclosed to a service provider or contractor for a business purpose during the preceding twelve months, state that fact here: [________________________________].
2.1 Sensitive Personal Information Detail
| Sensitive category | Collected? | Purpose | Used or disclosed outside 11 C.C.R. § 7027(m)? | Retention |
|---|---|---|---|---|
| Government identifiers | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Account log-in or financial account data with credentials | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Precise geolocation | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Contents of mail, email, or text messages when the business is not the intended recipient | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Genetic data | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Neural data | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Biometric information processed to uniquely identify a consumer | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Personal information collected and analyzed concerning health | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
| Personal information collected and analyzed concerning sex life or sexual orientation | ☐ Yes ☐ No | [____] | ☐ Yes ☐ No | [____] |
3. How We Use Personal Information
Replace this section with the specific approved purposes from the data map. Do not publish generic purposes that could justify any future use.
We collect and use personal information for these specific business or commercial purposes:
- [PURPOSE AND RELATED CATEGORIES: ______________________________________]
- [PURPOSE AND RELATED CATEGORIES: ______________________________________]
- [PURPOSE AND RELATED CATEGORIES: ______________________________________]
- [PURPOSE AND RELATED CATEGORIES: ______________________________________]
We will not collect an additional category or use collected information for an incompatible purpose without providing the notice required for that collection or use.
4. California Privacy Rights
Subject to applicability, scope, verification where permitted, and any current exception, California consumers may exercise the following rights:
- Know and access: request categories, sources, purposes, recipients, and specific pieces of personal information.
- Delete: request deletion of personal information collected from the consumer.
- Correct: request correction of inaccurate personal information maintained by us.
- Opt out of sale or sharing: direct us not to sell or share personal information when that right applies.
- Limit sensitive-personal-information use or disclosure: limit covered uses or disclosures when that right applies.
- ADMT opt out and access: use the applicable process described in Section 9 when Article 11 applies; a human appeal applies when the approved exception route relies on it.
- No retaliation: exercise CCPA rights without retaliation prohibited by the CCPA.
This section does not promise that every right applies to every record, activity, person, or request. The response will explain the action taken or the approved reason a request cannot be fulfilled.
5. How to Submit a Request
5.1 Requests to Know, Delete, or Correct
Toll-free number, if required: [________________________________]
Online form or portal: [________________________________]
Email address for an exclusively online business with a direct consumer relationship, if applicable: [________________________________]
Other method reflecting the primary interaction: [________________________________]
We will confirm receipt within ten business days and describe our general verification process and expected response time. We will respond within forty-five calendar days after receipt. If reasonably necessary, we may extend once for up to forty-five additional calendar days and will provide notice and an explanation.
5.2 Verification
We will use the following approved verification process, tailored to the request, account status, information requested, and risk of harm: [________________________________].
General verification description for publication: [________________________________]
5.3 Authorized Agents
An authorized agent may submit a request as permitted by current law. For a request to know, delete, or correct, we may require proof of signed permission and may ask the consumer to verify identity directly or confirm the permission directly. We do not require a power of attorney merely because a consumer uses an authorized agent.
Agent submission method: [________________________________]
6. Sale, Sharing, and Opt-Out Preference Signals
Current sale/share conclusion: ☐ We sell or share ☐ We do not sell or share ☐ Review incomplete
If we sell or share personal information, consumers may submit an opt-out request through:
- Do Not Sell or Share My Personal Information: [LINK]
- Alternative opt-out link, if used: [LINK]
- Other designated method: [________________________________]
We process a qualifying opt-out preference signal as a valid request for the browser or device and associated profiles as required by current law. We cease sale or sharing as soon as feasibly possible and no later than fifteen business days after receiving the request. We provide a means for the consumer to confirm that the request has been processed.
Signal scope and processing explanation: [________________________________]
Confirmation method: [________________________________]
A cookie banner or cookie controls alone are not presented as the sale-or-sharing opt-out method.
7. Limiting Use or Disclosure of Sensitive Personal Information
Applicability conclusion:
☐ We do not use or disclose sensitive personal information outside the purposes specified in 11 C.C.R. § 7027(m).
☐ The right to limit applies. Consumers may submit a request through:
- Limit the Use of My Sensitive Personal Information: [LINK]
- Alternative opt-out link, if used: [LINK]
- Other designated method: [________________________________]
Published explanation of covered uses and response process: [________________________________]
8. Consumers Under Sixteen
Actual-knowledge conclusion:
☐ We do not have actual knowledge that we sell or share personal information of consumers under sixteen.
☐ We sell or share information of consumers under thirteen and have attached the current parent-or-guardian opt-in process.
☐ We sell or share information of consumers at least thirteen and under sixteen and have attached the current consumer opt-in process.
Process and records location: [________________________________]
9. Automated Decisionmaking Technology
9.1 Applicability and Timing
Use of ADMT to make a significant decision concerning a consumer: ☐ Yes ☐ No ☐ Review
If yes, complete the current Article 11 program. A business using covered ADMT before January 1, 2027 must comply no later than January 1, 2027. A business using covered ADMT on or after that date must comply whenever it uses the technology for a significant decision.
9.2 Public-Facing Process
Pre-use Notice location: [________________________________]
Specific decision and purpose: [________________________________]
Opt-out method or identified exception: [________________________________]
Human-appeal method, if applicable: [________________________________]
ADMT access-request method: [________________________________]
Effective date of the completed process: [__/__/____]
Do not publish a generic statement that we use “AI to improve services” as a substitute for the specific Pre-use Notice and applicable rights process.
10. Financial Incentives and Different Prices or Service
Program offered: ☐ No ☐ Yes — attach current Notice of Financial Incentive
Program name: [________________________________]
Material terms, value method, opt-in process, and withdrawal method: [________________________________]
No discount, loyalty program, paid data arrangement, or different price or service is covered by this section unless the attached analysis and notice are complete.
11. Notice at Collection
This privacy policy does not replace a Notice at Collection unless the consumer is taken directly to the specific policy section containing every required item.
For each collection point, complete and deploy the following at or before collection:
| Collection point | Categories, including sensitive categories | Specific purposes | Sold or shared? | Retention period or criteria | Opt-out link, if required | Direct privacy-policy link | Approved and deployed |
|---|---|---|---|---|---|---|---|
| Website form | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Mobile application | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Telephone or in-person collection | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Paper form or signage | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Device, vehicle, kiosk, camera, or sensor | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Third-party collection on our property or interface | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
| Other: [________________] | [____] | [____] | [____] | [____] | [____] | [____] | ☐ |
12. Accessibility, Printing, Contact, and Updates
This policy is posted through a conspicuous link using the word “privacy,” is available in a format that permits printing, and is placed in the mobile application's settings menu when applicable.
Accessibility method and review: [________________________________]
Print-format test: [________________________________]
Questions or concerns: [________________________________]
Date last updated: [MONTH DAY, YEAR]
Twelve-month review owner and next review date: [________________________________]
Material operational changes must be reviewed against the Notice at Collection, consent, contract, purpose-compatibility, retention, and request-process rules before implementation; changing this policy after collection is not treated as automatic authorization.
Pre-Publication Counsel Checklist
☐ Confirm the current adjusted monetary threshold and every other applicability route.
☐ Map all online and offline categories, sources, purposes, recipients, sale/share activity, service-provider disclosures, and retention.
☐ Confirm the category letters and sensitive-information list against the current statute, including neural data.
☐ Confirm each collection point displays a complete Notice at Collection at or before collection.
☐ Test request methods, ten-business-day confirmation, forty-five-day response, extension notice, verification, agent, deletion, correction, access, and appeal workflows.
☐ Test opt-out preference signals, sale/share cessation, downstream notice, consumer confirmation, and sensitive-information limitation methods.
☐ Resolve under-sixteen, financial-incentive, ADMT, cybersecurity-audit, risk-assessment, data-broker, sectoral, and recordkeeping gates separately.
☐ Confirm vendor and third-party contracts match actual data flows and roles.
☐ Confirm the policy is conspicuous, accessible, printable, mobile-accessible, dated, and consistent with every deployed notice and interface.
☐ Delete drafting instructions and unused alternatives before publication.
About this template
- Last updated
- August 24, 2026
- Citations checked
- August 24, 2026
- Jurisdiction
- California
- Category
- Compliance & Regulatory
Legal authority
- Cal. Civ. Code § 1798.100(a)(1)-(3) (notice at collection and retention disclosure)
- Cal. Civ. Code § 1798.140(d)(1)(A) (adjusted annual-gross-revenue threshold)
- Cal. Civ. Code § 1798.140(d)(1)(B)-(C) (other business-definition thresholds)
- Cal. Civ. Code § 1798.140(v), (ae) (personal-information and sensitive-personal-information categories)
- 11 C.C.R. § 7011 (privacy policy requirements)
- 11 C.C.R. § 7012 (notice at collection requirements)
- 11 C.C.R. § 7016 (financial-incentive notice)
- 11 C.C.R. § 7021 (request-response timelines)
- 11 C.C.R. §§ 7025-7027 (opt-out and sensitive-information limitation requests)
- 11 C.C.R. § 7063 (authorized agents)
- 11 C.C.R. §§ 7070-7072 (consumers under sixteen)
- 11 C.C.R. §§ 7200, 7220-7222 (automated decisionmaking technology requirements)
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
A reviewer verified this template's legal citations against the official source on August 24, 2026.
Cal. Civ. Code § 1798.100(a)(1)-(3) (checked August 24, 2026): "A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following: The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section. If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose."
Cal. Civ. Code § 1798.140(d)(1)(A) (checked August 24, 2026): "Effective 1/1/2025; posted 12/17/2024. Every odd-numbered year, Civil Code § 1798.199.95(d) adjusts the following monetary thresholds in the CCPA to reflect increases in the Consumer Price Index. Effective January 1, 2025, the new amounts are as follows: Civil Code § 1798.140(d)(1)(A): Annual gross revenue amount within the definition of “business” $26,625,000"
Cal. Civ. Code § 1798.140(d)(1)(B)-(C) (checked August 24, 2026): "Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households. Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information."
Cal. Civ. Code § 1798.140(v), (ae) (checked August 24, 2026): "Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household: Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. Any personal information described in subdivision (e) of Section 1798.80. Characteristics of protected classifications under California or federal law. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Biometric information. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement. Geolocation data. Audio, electronic, visual, thermal, olfactory, or similar information. Professional or employment-related information. Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99). Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Sensitive personal information. Sensitive personal information means personal information that reveals: A consumer’s social security, driver’s license, state identification card, or passport number. A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. A consumer’s precise geolocation. A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. A consumer’s genetic data. A consumer’s neural data. The processing of biometric information for the purpose of uniquely identifying a consumer. Personal information collected and analyzed concerning a consumer’s health. Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation."
Draft your California CCPA/CPRA Privacy Notice in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.