Law / United States / 
California
California Online Privacy Protection Act of 2003
Officially California Online Privacy Protection Act (CalOPPA): privacy policy posting and contents
Also known as CalOPPA.
Cal. Bus. and Prof. Code sections 22575 to 22579
In force since .
A data subject rights rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Disclosure
- Audit expectation
- none
As of .
What it requires
- Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
- List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
- Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
- Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
- Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
- Post a missing privacy policy within 30 days of being notified that it is missing.
These lines are LexLint's reading of the law's text, as of . Also read by: California Department of Justice, Office of the Attorney General, Privacy Enforcement and Protection Unit (guidance, recorded ).
Who enforces it
Enforcement body
California Attorney General. The chapter names no enforcing body, states no penalty and creates no private right of action of its own. A violation can be pursued as an unlawful business practice under the Unfair Competition Law (Bus. and Prof. Code section 17200 et seq.), which lets the Attorney General, a district attorney and certain city attorneys and county counsel seek a civil penalty of up to $2,500 per violation (section 17206), and lets a person who has suffered injury in fact and lost money or property as a result sue (section 17204).
Settledness
The Attorney General's May 2014 guidance states that the chapter does not define "online service" and that the Attorney General regards a mobile application as one, and that the chapter sets no requirement for how an operator responds to a Do Not Track signal, only that the response be disclosed. Honoring an opt-out preference signal is a separate duty under the California Consumer Privacy Act.
- As of
- Guidance link
- https://oag.ca.gov/sites/all/files/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf
- Guidance body
- California Department of Justice, Office of the Attorney General, Privacy Enforcement and Protection Unit
- Open questions
- Does the chapter reach a business-to-business service whose users act for their employer, given that Business and Professions Code section 22577(d) defines a "consumer" as an individual who seeks goods or services "for personal, family, or household purposes"?
- Does an operator that embeds a third party's analytics or advertising code itself "engage in" collection of a user's activity over time and across third-party sites, so that section 22575(b)(5) requires it to disclose how it responds to Do Not Track signals?
What this law does
Requires the operator of a commercial website or online service that collects personally identifiable information online from California residents who use or visit it to conspicuously post a privacy policy, and to follow it. No revenue, volume or headcount threshold applies, so the duty reaches operators the California Consumer Privacy Act does not.
The policy must list the categories of personally identifiable information collected and the categories of third parties it may be shared with, describe any process for reviewing and requesting changes to that information and how material changes to the policy are notified, and state its effective date.
Since the 2013 amendments (AB 370), it must also disclose whether other parties may collect information about a user's activity over time and across sites and, if the operator itself collects such information, how it responds to browser Do Not Track signals. A failure to post is a violation only 30 days after the operator is notified of it. Failing to comply with section 22575 or with the posted policy is a violation when knowing and willful, or negligent and material. The chapter preempts local rules on posting a privacy policy.
When LexLint raises it
When your app profile says your app deploys a chatbot, sends automated outreach, operates a social platform, operates an app store, ships a mobile app or tracks devices.