Law / United States / 
California
CCPA Regulations: privacy policy and required notices (article 2)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7010 to 7016
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Disclosure
As of .
What it requires
- Provide a privacy policy that describes your online and offline information practices and your consumers' rights, make it available in a format a consumer can print, and post it online through a conspicuous link using the word privacy on your website homepage or on your mobile application's download or landing page (sections 7010(a) and 7011).
- If you offer a mobile application, include a link to the privacy policy in the application's settings menu (section 7011(d)).
- If you control the collection of a consumer's personal information, give a notice at collection where consumers will encounter it at or before the point of collection, whether online, in an application or offline (sections 7010(b) and 7012).
- If you sell or share personal information, provide a notice of right to opt out of sale or sharing, or the alternative opt-out link (sections 7010(e), 7013 and 7015).
- If you use or disclose sensitive personal information for purposes beyond those listed in section 7027(m), provide a notice of right to limit or the alternative opt-out link (sections 7010(f) and 7014).
- If you offer a financial incentive or a price or service difference, provide a notice of financial incentive (sections 7010(g) and 7016).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Article 2 of the CCPA Regulations governs required disclosures to consumers, beginning with an overview of the required disclosures in section 7010. Every business that must comply with the CCPA and the Regulations must provide a privacy policy. A business that controls the collection of a consumer's personal information from the consumer must provide a notice at collection.
The privacy policy must be posted online and reached through a conspicuous link using the word privacy on the business's website homepage or on the download or landing page of a mobile application. A mobile application must also include a link to the privacy policy in the application's settings menu. The notice at collection must be made readily available where consumers will encounter it at or before the point of collection of any personal information.
A business that sells or shares personal information must provide a notice of right to opt out of sale or sharing or the alternative opt-out link. A business that offers a financial incentive or price or service difference must provide a notice of financial incentive. The Agency's regulations became effective on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings, processes biometric data or ships a mobile app.