The California Consumer Privacy Act (CCPA), amended by CPRA, grants California residents rights over personal information businesses collect. It affects many US websites — not only California companies.
Who must comply
Broadly, for-profit businesses that collect California personal information and meet thresholds (revenue, data volume, or revenue from selling/sharing PI) — or certain data broker activities. Many growing SaaS and ecommerce sites trigger CCPA/CPRA.
When in doubt, assume California visitors matter and publish strong disclosures.
Consumer rights under CCPA/CPRA
- Know what is collected, used, shared, or sold
- Delete personal information (with exceptions)
- Opt out of sale/sharing for cross-context behavioral advertising
- Correct inaccurate information (CPRA)
- Limit use of sensitive personal information (CPRA)
- Non-discrimination for exercising rights
Privacy policies must describe categories collected, purposes, retention, and how to submit requests.
Privacy policy requirements
California law requires a conspicuous privacy policy describing practices. CPRA adds sensitive PI categories and sharing disclosures.
Your policy should include:
- Categories of PI collected (last 12 months)
- Sources and business/commercial purposes
- Categories disclosed to third parties
- Sale/sharing disclosures and opt-out link if applicable ("Do Not Sell or Share")
- Retention criteria
- Rights and contact methods (toll-free or web form)
CCPA vs cookie consent
CCPA opt-out of sale/sharing may require a "Do Not Sell or Share" link — distinct from EU cookie banners. Clerica does not ship CCPA opt-out tools today; focus on accurate policy disclosures and generator coverage.
Next steps
- Inventory PI categories you collect from Californians
- Generate policy with Privacy Policy Generator
- Add opt-out mechanisms if you sell/share for advertising (counsel advised)
- See CCPA requirements guide and checklist
Related: US data privacy laws · US privacy overview · CCPA template
Clerica is not a law firm and does not provide legal advice. This guide is educational. Consult qualified counsel for jurisdiction-specific requirements.