CCPA/CPRA requires businesses to provide specific disclosures about personal information practices. Your privacy policy is the primary public artifact.
Categories of personal information
Disclose categories collected in the preceding 12 months, such as:
- Identifiers (name, email, IP)
- Commercial information
- Internet/network activity
- Geolocation
- Professional or employment information
- Sensitive personal information (CPRA)
Map your analytics, CRM, and payment stack to these categories honestly.
Sources, purposes, and disclosure
For each category explain:
- Sources — directly from consumer, automatically, third parties
- Business/commercial purposes — service delivery, analytics, security, marketing
- Categories shared with third parties — ad networks, subprocessors
Sale and sharing (CPRA)
If you sell or share PI for cross-context behavioral advertising, disclose it and provide "Do Not Sell or Share My Personal Information" link. Many analytics/ad setups trigger sharing — counsel should assess.
Clerica generator helps draft disclosures; opt-out tooling is not our product today.
Retention
Describe retention criteria or periods per category — not unlimited retention by default.
Consumer rights section
Explain how Californians can:
- Request access/know categories
- Request deletion
- Opt out of sale/sharing
- Correct inaccurate data (CPRA)
- Limit sensitive PI use (CPRA)
Include two or more designated methods — toll-free number, web form, email.
Non-discrimination
State you will not discriminate for exercising rights.
Updates and effective date
Show Last updated and notify consumers of material changes where required.
Generate and certify
Privacy Policy Generator · CCPA checklist · CCPA template · US privacy laws tracker
Clerica is not a law firm and does not provide legal advice. This guide is educational. Consult qualified counsel for jurisdiction-specific requirements.