STATE PRIVACY NOTICE OVERLAYS - CALIFORNIA

CALIFORNIA (CPRA)

• Consumer rights: know/access, delete, correct, opt-out of sale/share, limit use of sensitive PI.
• Provide "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links if applicable.
• Disclose categories, purposes, retention, third parties, and whether sharing for cross-context behavioral advertising.
• Honor opt-out preference signals (GPC) where required.
• Contractor/service provider clauses: no selling/sharing, no combining data beyond contract purposes.

UNIVERSAL IMPLEMENTATION NOTES

• Intake and verify rights requests; respond within statutory timelines.
• Document appeals process for denied requests where required by law.
• Update cookies/SDKs and consent/opt-out flows to match disclosures.
• Track retention schedules; minimize sensitive data.
• Update vendor DPAs to include state-specific terms.

[// GUIDANCE: If handling children's data (under 16/13), layer on COPPA/child-consent rules and under-18 sensitive treatment where applicable. If selling/sharing, maintain a sales/sharing register and contract restrictions.]