California CCPA/CPRA Privacy Notice
CALIFORNIA CONSUMER PRIVACY ACT (CCPA/CPRA) PRIVACY NOTICE
Effective Date: [DATE]
Last Updated: [DATE]
NOTICE AT COLLECTION OF PERSONAL INFORMATION
This Privacy Notice is provided pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), codified at California Civil Code Section 1798.100 et seq., and implementing regulations at 11 CCR Section 7010 et seq.
1. SCOPE OF THIS NOTICE
This Notice applies to California residents ("consumers") as defined by Cal. Civ. Code Section 1798.140(i) and describes how [COMPANY NAME] ("Company," "we," "us," or "our") collects, uses, discloses, and retains personal information about California consumers.
1.1 Applicability Thresholds
This Notice applies because [COMPANY NAME] meets one or more of the following thresholds under Cal. Civ. Code Section 1798.140(d):
☐ Annual gross revenues exceeding $25,000,000 in the preceding calendar year
☐ Annually buys, sells, or shares the personal information of 100,000 or more consumers or households
☐ Derives 50% or more of annual revenues from selling or sharing consumers' personal information
2. CATEGORIES OF PERSONAL INFORMATION COLLECTED
Pursuant to Cal. Civ. Code Section 1798.100(a) and 11 CCR Section 7011(e), we collect the following categories of personal information:
2.1 Categories Collected in the Preceding 12 Months
| Category | Examples | Collected | Source | Business Purpose | Sold/Shared |
|---|---|---|---|---|---|
| A. Identifiers | Real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, SSN, driver's license number, passport number | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| B. Personal Information (Cal. Civ. Code Section 1798.80(e)) | Name, signature, SSN, physical characteristics, address, telephone number, passport number, driver's license number, education, employment, employment history, bank account number, credit/debit card number, financial information, medical information, health insurance information | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| C. Protected Classifications | Age (40+), race, color, ancestry, national origin, citizenship, religion, marital status, medical condition, physical/mental disability, sex, sexual orientation, veteran/military status, genetic information | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| D. Commercial Information | Records of personal property, products/services purchased, obtained, or considered, purchasing/consuming histories or tendencies | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| E. Biometric Information | Genetic, physiological, behavioral, and biological characteristics; activity patterns used to extract a template or other identifier; fingerprints, faceprints, voiceprints, iris/retina scans, keystroke, gait, or other physical patterns; sleep, health, or exercise data | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| F. Internet/Network Activity | Browsing history, search history, information on consumer's interaction with a website, application, or advertisement | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| G. Geolocation Data | Physical location or movements | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| H. Sensory Data | Audio, electronic, visual, thermal, olfactory, or similar information | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| I. Professional/Employment Information | Current or past job history, performance evaluations | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| J. Non-Public Education Information | Education records directly related to a student maintained by an educational institution or party acting on its behalf, per FERPA (20 U.S.C. Section 1232g, 34 C.F.R. Part 99) | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| K. Inferences | Profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
| L. Sensitive Personal Information | See Section 2.2 below | ☐ Yes ☐ No | [SOURCE] | [PURPOSE] | ☐ Yes ☐ No |
2.2 Sensitive Personal Information
Pursuant to Cal. Civ. Code Section 1798.140(ae) and 11 CCR Section 7011(e)(1)(L), we collect the following categories of sensitive personal information:
| Sensitive Category | Collected | Purpose | Right to Limit |
|---|---|---|---|
| Social Security, driver's license, state ID, or passport number | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Account log-in, financial account, debit/credit card number with access code/password | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Precise geolocation | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Racial or ethnic origin | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Religious or philosophical beliefs | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Union membership | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Contents of mail, email, or text messages (unless intended for Company) | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Genetic data | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Processing of biometric information for unique identification | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Health information | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
| Sex life or sexual orientation data | ☐ Yes ☐ No | [PURPOSE] | ☐ Applicable |
3. PURPOSES FOR COLLECTION AND USE
Pursuant to Cal. Civ. Code Section 1798.100(a)(1) and 11 CCR Section 7011(e)(1)(C), we collect and use personal information for the following business and commercial purposes:
3.1 Business Purposes
☐ Auditing - Counting ad impressions, verifying quality of ads, auditing compliance
☐ Security - Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, prosecuting responsible parties
☐ Debugging - Identifying and repairing errors that impair existing intended functionality
☐ Short-term, Transient Use - Contextual customization of ads, non-personalized use where information is not disclosed or used to build profiles
☐ Service Provision - Performing services including maintaining accounts, customer service, processing transactions, verification, payment processing, financing, analytics, storage
☐ Internal Research - Research for technological development and demonstration
☐ Quality and Safety - Verifying, maintaining, or improving the quality or safety of services/devices owned or controlled by us
3.2 Commercial Purposes
☐ Advertising and marketing
☐ Advancing commercial or economic interests
☐ Inducing purchase of products or services
3.3 Additional Purposes
[DESCRIBE ANY ADDITIONAL PURPOSES]
4. SOURCES OF PERSONAL INFORMATION
Pursuant to 11 CCR Section 7011(e)(1)(B), we collect personal information from the following sources:
☐ Directly from You - Information you provide when you create an account, make a purchase, submit forms, or communicate with us
☐ Automatically - Information collected automatically when you use our services (cookies, pixel tags, web beacons, log files)
☐ From Third Parties - Information from:
- Service providers and contractors
- Business partners
- Advertising networks
- Data analytics providers
- Data brokers
- Social media platforms
- Government entities/public records
- Other consumers
☐ Inferences - Information derived from other personal information we collect
5. DISCLOSURE OF PERSONAL INFORMATION
5.1 Categories of Third Parties
Pursuant to 11 CCR Section 7011(e)(1)(D-E), we disclose personal information to the following categories of third parties:
| Third Party Category | Categories of PI Disclosed | Purpose |
|---|---|---|
| Service Providers | [CATEGORIES] | [PURPOSE] |
| Contractors | [CATEGORIES] | [PURPOSE] |
| Business Partners | [CATEGORIES] | [PURPOSE] |
| Advertising Networks | [CATEGORIES] | [PURPOSE] |
| Data Analytics Providers | [CATEGORIES] | [PURPOSE] |
| Government Entities | [CATEGORIES] | [PURPOSE] |
| Other Businesses | [CATEGORIES] | [PURPOSE] |
5.2 Disclosure vs. Sale vs. Sharing
Pursuant to Cal. Civ. Code Section 1798.140(ad) (sale) and Section 1798.140(ah) (share):
"Sale" means disclosing personal information for monetary or other valuable consideration.
"Sharing" means disclosing personal information for cross-context behavioral advertising, whether or not for monetary or valuable consideration.
| Category of PI | Disclosed for Business Purpose | Sold | Shared |
|---|---|---|---|
| Identifiers | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Personal Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Protected Classifications | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Commercial Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Biometric Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Internet/Network Activity | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Geolocation Data | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Sensory Data | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Professional/Employment Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Non-Public Education Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Inferences | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
| Sensitive Personal Information | ☐ Yes ☐ No | ☐ Yes ☐ No | ☐ Yes ☐ No |
6. RETENTION OF PERSONAL INFORMATION
Pursuant to Cal. Civ. Code Section 1798.100(a)(3) and 11 CCR Section 7011(e)(1)(G), we retain personal information as follows:
| Category of PI | Retention Period | Criteria |
|---|---|---|
| Identifiers | [PERIOD] | [CRITERIA] |
| Personal Information | [PERIOD] | [CRITERIA] |
| Protected Classifications | [PERIOD] | [CRITERIA] |
| Commercial Information | [PERIOD] | [CRITERIA] |
| Biometric Information | [PERIOD] | [CRITERIA] |
| Internet/Network Activity | [PERIOD] | [CRITERIA] |
| Geolocation Data | [PERIOD] | [CRITERIA] |
| Sensory Data | [PERIOD] | [CRITERIA] |
| Professional/Employment Information | [PERIOD] | [CRITERIA] |
| Non-Public Education Information | [PERIOD] | [CRITERIA] |
| Inferences | [PERIOD] | [CRITERIA] |
| Sensitive Personal Information | [PERIOD] | [CRITERIA] |
7. CALIFORNIA CONSUMER RIGHTS
7.1 Your Rights Under the CCPA/CPRA
Pursuant to Cal. Civ. Code Sections 1798.100-1798.135, California consumers have the following rights:
Right to Know (Cal. Civ. Code Section 1798.100, 1798.110, 1798.115)
You have the right to request that we disclose:
- Categories of personal information collected
- Categories of sources from which PI was collected
- Business or commercial purpose for collection, selling, or sharing
- Categories of third parties to whom PI is disclosed
- Specific pieces of personal information collected about you
Right to Delete (Cal. Civ. Code Section 1798.105)
You have the right to request deletion of personal information we collected from you, subject to certain exceptions including:
- Completing transactions or providing requested services
- Security purposes
- Debugging
- Free speech rights
- Compliance with legal obligations
- Internal uses reasonably aligned with consumer expectations
Right to Correct (Cal. Civ. Code Section 1798.106)
You have the right to request correction of inaccurate personal information we maintain about you.
Right to Opt-Out of Sale/Sharing (Cal. Civ. Code Section 1798.120, 1798.135)
You have the right to opt out of:
- The sale of your personal information
- The sharing of your personal information for cross-context behavioral advertising
Right to Limit Use of Sensitive Personal Information (Cal. Civ. Code Section 1798.121)
You have the right to limit our use of sensitive personal information to:
- Performing services or providing goods reasonably expected
- Detecting security incidents
- Resisting malicious, deceptive, fraudulent, or illegal actions
- Ensuring physical safety
- Short-term transient use
- Performing or providing services on behalf of the business
- Verifying or maintaining quality or safety
- As authorized by regulation
Right to Non-Discrimination (Cal. Civ. Code Section 1798.125)
You have the right not to receive discriminatory treatment for exercising your privacy rights. We will not:
- Deny goods or services
- Charge different prices
- Provide different quality of goods or services
- Suggest you will receive different treatment
7.2 How to Exercise Your Rights
Submit a Request:
☐ Online: [WEBSITE URL/PRIVACY PORTAL]
☐ Email: [PRIVACY EMAIL ADDRESS]
☐ Phone: [TOLL-FREE NUMBER]
☐ Mail: [PHYSICAL ADDRESS]
Verification Requirements:
Pursuant to 11 CCR Section 7062-7063, we will verify your identity before fulfilling your request by:
- Matching at least two data points you provide with data we maintain
- For sensitive requests, matching at least three data points and obtaining a signed declaration under penalty of perjury
Authorized Agents:
Pursuant to 11 CCR Section 7063(e), you may designate an authorized agent to submit requests on your behalf. We may require:
- Written permission signed by you
- Verification of your identity directly
- Agent registration with the California Secretary of State (if applicable)
Response Timeframe:
Pursuant to Cal. Civ. Code Section 1798.145(g)(1) and 11 CCR Section 7021:
- We will confirm receipt within 10 business days
- We will respond within 45 calendar days
- We may extend response time by an additional 45 days when reasonably necessary
8. OPT-OUT OF SALE/SHARING
8.1 Do Not Sell or Share My Personal Information
Pursuant to Cal. Civ. Code Section 1798.135 and 11 CCR Section 7013, you may opt out of the sale or sharing of your personal information.
Methods to Opt-Out:
☐ "Do Not Sell or Share My Personal Information" Link: [LINK]
☐ "Limit the Use of My Sensitive Personal Information" Link: [LINK]
☐ Alternative Opt-Out Link (if combined): [LINK]
8.2 Global Privacy Control (GPC) / Universal Opt-Out Mechanisms
Pursuant to Cal. Civ. Code Section 1798.135(b)(1) and 11 CCR Section 7025, we honor opt-out preference signals including:
☐ Global Privacy Control (GPC) - We process GPC signals as valid opt-out requests
☐ Other Universal Opt-Out Mechanisms: [SPECIFY]
Opt-Out Confirmation: Pursuant to 11 CCR Section 7026(h), we provide visible confirmation when your opt-out request is honored (effective January 1, 2026).
8.3 Minors
Pursuant to Cal. Civ. Code Section 1798.120(c):
- We do not knowingly sell or share personal information of consumers under 16 years of age
- For consumers under 16, we require affirmative authorization (opt-in)
- For consumers under 13, we require parental/guardian consent
9. AUTOMATED DECISION-MAKING TECHNOLOGY (ADMT)
Pursuant to Cal. Civ. Code Section 1798.185(a)(16) and 11 CCR Section 7030-7032 (effective January 1, 2027):
9.1 Use of ADMT
☐ We use automated decision-making technology that processes personal information to make significant decisions about consumers
☐ We do not use automated decision-making technology for significant decisions
9.2 Types of ADMT Used
| ADMT Type | Purpose | Output | Consumer Rights |
|---|---|---|---|
| [TYPE] | [PURPOSE] | [OUTPUT] | ☐ Opt-out ☐ Access ☐ Explanation |
9.3 Your Rights Regarding ADMT
If we use ADMT for significant decisions, you have the right to:
- Opt out of ADMT for significant decisions
- Access information about ADMT use
- Request meaningful information about the logic involved
10. FINANCIAL INCENTIVE PROGRAMS
Pursuant to Cal. Civ. Code Section 1798.125(b) and 11 CCR Section 7016:
10.1 Description of Financial Incentive Programs
☐ We offer the following financial incentive programs:
| Program Name | Description | Terms | Value Calculation |
|---|---|---|---|
| [NAME] | [DESCRIPTION] | [LINK TO TERMS] | [METHOD] |
10.2 Material Terms
- How to opt-in: [DESCRIPTION]
- How to opt-out: [DESCRIPTION]
- Value provided: [DESCRIPTION]
- Good-faith estimate of value of data: [CALCULATION METHOD]
☐ We do not offer financial incentive programs
11. UPDATES TO THIS NOTICE
Pursuant to 11 CCR Section 7011(e)(2), we will update this Notice as required. We will provide notice of material changes:
☐ By posting the updated Notice on our website
☐ By email to registered users
☐ By other reasonable means
12. CONTACT INFORMATION
For questions about this Notice or to exercise your rights:
Privacy Contact:
- Email: [EMAIL]
- Phone: [TOLL-FREE NUMBER]
- Mail: [ADDRESS]
California Privacy Rights Requests:
- Online Portal: [URL]
- Email: [DESIGNATED EMAIL]
13. ADDITIONAL CALIFORNIA RIGHTS
13.1 California's "Shine the Light" Law (Cal. Civ. Code Section 1798.83)
California residents may request information about personal information disclosed to third parties for direct marketing purposes.
13.2 California Online Privacy Protection Act (CalOPPA)
Our website complies with CalOPPA requirements including Do Not Track signal responses.
DOCUMENT CONTROL
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | [DATE] | [NAME] | Initial version |
| 2.0 | [DATE] | [NAME] | Updated for 2026 regulations |
Legal Review: ☐ Completed Date: _________ Reviewer: _________
Next Review Date: _____________
This Notice is provided for informational purposes and does not constitute legal advice. Consult with qualified legal counsel for compliance with California privacy laws.
About This Template
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Important Notice
This template is provided for informational purposes. It is not legal advice. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Last updated: February 2026