CCPA and CPRA Privacy Policy Requirements for California Businesses

The California Consumer Privacy Act took effect in 2020 and the California Privacy Rights Act amended it substantially starting January 1, 2023, adding a new category of protected data, a new state agency to enforce it, and a longer list of things a privacy policy has to say. A privacy policy written for CCPA alone, before the 2023 amendments, is missing disclosures the law now requires. Here is what the current version of the law expects a California business’s privacy policy to cover.

Does the CCPA/CPRA Apply to Your Business

The CCPA and CPRA only apply to a “business” as the statute defines it, and the definition is threshold-based rather than a blanket rule for every company that touches a California resident’s data. A for-profit entity doing business in California has to meet at least one of three thresholds before the law’s obligations, including the privacy policy requirements below, attach.

The 100,000-consumer threshold is the one that catches businesses by surprise. It was 50,000 under the original CCPA; CPRA raised it to 100,000, but that number counts consumers and households combined, and a mid-sized e-commerce site or SaaS product with a free tier can clear it well before it clears the revenue threshold. If your company sits below all three lines, the CCPA does not impose its disclosure requirements on you, though writing a clear privacy policy is still good practice and may be required by other laws your users fall under, GDPR for EU visitors being the most common one; see our guide to GDPR privacy policy requirements if you serve both audiences.

What the Privacy Policy Itself Has to Disclose

Once the law applies, California Civil Code 1798.130 sets out what the privacy policy has to include, and it is more granular than a general-purpose disclosure. The policy has to state, for the preceding 12 months: the categories of personal information collected, the categories of sources that information came from, the business or commercial purpose for collecting, selling, or sharing it, the categories of third parties the information was disclosed to, and either the categories of personal information sold or shared and to whom, or an affirmative statement that the business does not sell or share personal information if that is accurate.

That last piece matters because “we do not sell your data” is a claim CPRA takes literally, and the definition of “sale” and the newer, separate definition of “share” both matter here. A sale is any exchange of personal information for monetary or other valuable consideration. Sharing is CPRA’s added concept, specifically covering disclosure of personal information to a third party for cross-context behavioral advertising, even when no money changes hands, which is exactly what happens when a site drops an ad-tech pixel that lets a network build a profile across unrelated sites. A business running standard third-party ad pixels or analytics tags that build cross-site profiles is very likely “sharing” personal information under this definition even if it has never sold a customer list to anyone, and the privacy policy has to reflect that rather than the narrower, pre-CPRA reading of “sale” alone.

Sensitive Personal Information Is Its Own Category

CPRA introduced sensitive personal information (SPI) as a distinct category with its own disclosure and consumer-rights obligations, something the original CCPA did not separate out. The statute lists specific categories: Social Security, driver’s license, state ID, or passport numbers; account login credentials combined with a password or security code that would grant access; precise geolocation; race, ethnicity, religious or philosophical beliefs, or union membership; the contents of mail, email, or text messages unless the business is the intended recipient; genetic data; biometric information used to identify a specific individual; health information; and information about a person’s sex life or sexual orientation.

If a business collects any of these, the privacy policy has to identify which categories and the purpose for collecting each one, separately from the general personal-information disclosure. Consumers also get a distinct right here, the right to limit a business’s use and disclosure of sensitive personal information to what’s necessary to perform the service, which the policy has to describe and provide a mechanism to exercise, typically a “Limit the Use of My Sensitive Personal Information” link alongside the sale/share opt-out.

The Consumer Rights the Policy Has to List

The original CCPA gave California residents the right to know what’s collected, the right to delete it, the right to opt out of its sale, and the right to non-discrimination for exercising those rights. CPRA added to that list rather than replacing it, and a policy drafted before 2023 is missing the additions.

The policy needs to describe each right in plain language and give at least two designated methods for submitting a request, commonly a toll-free number and a web form, along with how the business verifies the person making the request is who they claim to be before acting on it. It also needs an appeal path: if a business denies a correction or deletion request, CPRA gives the consumer a right to appeal that denial, and the policy has to say how.

The Opt-Out Link and Global Privacy Control

Any business that sells or shares personal information has to post a clear, conspicuous link, historically “Do Not Sell My Personal Information,” now more often “Your Privacy Choices” paired with the standardized opt-out toggle icon, since CPRA regulations allow combining the sale and share opt-outs into one link rather than running two separate ones. The link has to lead to a page or mechanism that lets a visitor opt out without having to create an account or otherwise clear an unnecessary hurdle first.

The regulations also require a business to treat a Global Privacy Control signal, a browser-level or extension-level setting a visitor turns on once and that then broadcasts an opt-out preference automatically to every site visited, as a valid opt-out-of-sale-and-sharing request, without the visitor having to separately click the site’s own link. A privacy policy that documents an opt-out mechanism but doesn’t mention GPC recognition is describing an incomplete process, and it’s a gap regulators have specifically flagged in enforcement actions.

The wording of the disclosure itself is where a lot of otherwise-compliant policies fall short, not because the underlying practice is wrong but because the sentence describing it is too vague to tell a reader what’s actually happening.

The specific version names what’s shared, why, which legal category it falls under, and exactly how to stop it, which is what the statute is actually asking the policy to do. If your business’s own sale/share disclosure looks closer to the vague version, that’s the sentence to rewrite first.

Minors and the 12-Month Update Requirement

Two more requirements round out the policy. If a business has actual knowledge that it sells or shares the personal information of consumers under 16, the policy has to disclose that and describe the opt-in consent process CPRA requires for that age group, affirmative opt-in from the minor if they’re 13 to 15, or from a parent or guardian if they’re under 13, rather than the default opt-out model that applies to adults. And the policy as a whole has to be updated at least once every 12 months, with the update reflected in a visible “last updated” date, which means a static policy that hasn’t been touched since it launched is itself a compliance gap even if nothing else about the business’s data practices changed.

It’s worth separating this document from the shorter “notice at collection” California law also requires, a brief summary shown at or before the point personal information is gathered (a form, a checkout page, an account signup) that states the categories collected and whether they’re sold or shared, with a link through to the full privacy policy for the rest of the detail. The two documents work together, one is the summary at the moment of collection, the other is the comprehensive reference; see our comparison of privacy policy vs. terms and conditions for how the privacy policy fits alongside a site’s other required legal documents, and cookie policy vs. privacy policy for where cookie and tracking disclosures, closely tied to the sale/share opt-out above, belong.

Enforcement Has Real Teeth Now

CPRA also changed how violations are enforced. It created the California Privacy Protection Agency, a dedicated regulator with rulemaking and enforcement authority that didn’t exist under the original CCPA, and it removed the 30-day cure period that used to give a business a window to fix a violation before facing a penalty. Civil penalties run up to $2,500 per violation, or up to $7,500 per violation that’s intentional or that involves a minor under 16, and with the cure period gone, an inaccurate or outdated privacy policy is a live liability rather than something there’s guaranteed time to correct after the fact.

Putting It Together

A CCPA/CPRA-compliant privacy policy, read in order, covers: the categories of personal information collected and their sources, the business or commercial purpose for processing, whether and to whom information is sold or shared, a separate disclosure for sensitive personal information and its own opt-out, the full list of consumer rights including correction and appeal, the opt-out link with Global Privacy Control recognition, the minors’ opt-in disclosure if applicable, and a “last updated” date no more than 12 months old. Missing any one section doesn’t necessarily make the whole policy void, but it is exactly the kind of gap a regulator or a plaintiff’s attorney looks for first, because it is the part of the document a business is most likely to have skipped or let go stale.

Our privacy policy generator builds a policy structured around these CCPA/CPRA sections directly, so the sale/share disclosure, the sensitive personal information category, and the consumer rights list are populated from your answers rather than adapted from a template written before the 2023 amendments took effect.