CCPA privacy policy checklist (11 CCR § 7011)

The policy is meant to give “a comprehensive description of a business’s online and offline information practices” and to tell consumers how to exercise their rights (11 CCR § 7011(a)). Before the content, check the form:

• Plain, straightforward language without technical or legal jargon (§ 7003(a)).
• Readable on small screens, and accessible to people with disabilities following recognized standards such as WCAG 2.1 (§ 7003(b)).
• Available in the languages the business ordinarily uses with California consumers (§ 7003(b)(2)).
• Printable as a document (§ 7011(c)).
• Linked conspicuously from the home page, with the word “privacy” in the link (§ 7011(d)); in a mobile app, also from the app’s settings menu.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)

The policy must identify (§ 7011(e)(1)):

• The categories of personal information collected in the preceding 12 months, described with the terms of Cal. Civ. Code § 1798.140.
• The categories of sources the information comes from.
• The specific business or commercial purpose for collecting it.
• The categories sold or shared to third parties in the preceding 12 months — or a statement that none were.
• For each of those categories, the categories of third parties that received them.
• The purpose of selling or sharing.
• Whether the business knowingly sells or shares the personal information of consumers under 16.
• The categories disclosed to service providers or contractors for a business purpose in the preceding 12 months, and the purpose — or a statement that none were.
• Whether the business uses or discloses sensitive personal information beyond the purposes the regulations allow.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)

The policy must explain the rights the CCPA gives consumers (§ 7011(e)(2)):

• The right to know what personal information the business has collected, including the specific pieces.
• The right to delete, subject to exceptions.
• The right to correct inaccurate information.
• The right to opt out of sale or sharing, if the business sells or shares.
• The right to limit the use of sensitive personal information, if the business uses it beyond the permitted purposes.
• The rights to opt out of and to access automated decision-making technology, if the business uses it as the regulations describe.
• The right not to be retaliated against for exercising these rights, including as a job applicant, employee or contractor.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)

The policy must explain how consumers exercise their rights and what to expect (§ 7011(e)(3)):

• The methods for submitting requests, with instructions and any link to an online form or portal.
• The Notice of Right to Opt-out, or a link to it, if the business sells or shares.
• The Notice of Right to Limit, or a link to it, where it is required.
• How the business verifies requests to know, delete and correct, and what the consumer must provide.
• How an opt-out preference signal such as Global Privacy Control is processed — whether it applies to the device, the browser, the consumer’s account or offline sales — and how the consumer can use one.
• If the business processes opt-out preference signals in a frictionless manner, how consumers can set them up.
• How an authorized agent can make a request for the consumer.
• If the business knowingly sells the personal information of consumers under 16, the opt-in processes the regulations require.
• A contact for questions about the policy, reflecting how the business mainly interacts with consumers.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)

For requests to know, delete and correct, the statute requires “two or more designated methods”, including at a minimum a toll-free telephone number, and the website itself if the business has one (Cal. Civ. Code § 1798.130(a)(1)). One exception: a business that operates exclusively online and has a direct relationship with the consumer only has to provide an e-mail address. The policy has to name these methods (§ 1798.130(a)(5)(A)).

Opt-outs follow their own rule: a business that collects personal information online must accept them at least through an opt-out preference signal and one other method, such as the form behind the “Do Not Sell or Share” link (11 CCR § 7026(a)(1)).

Sources: CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA) · CCPA regulations, 11 CCR § 7000 ff. (CPPA)

How long each category of personal information is kept — or, if that is not possible, the criteria used to decide — is required in the notice at collection (Cal. Civ. Code § 1798.100(a)(3); 11 CCR § 7012(e)(4)). Online, that notice may be a link that takes the visitor directly to the section of the privacy policy holding the required information (§ 7012(f)). Many businesses therefore keep a retention period for each category in the policy itself. A single sentence such as “we keep data as long as necessary” does not give a period or criteria for each category.

Sources: CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA) · CCPA regulations, 11 CCR § 7000 ff. (CPPA)

The policy must show the date it was last updated (11 CCR § 7011(e)(4)). The statute requires the business to update the information in the policy “at least once every 12 months” (Cal. Civ. Code § 1798.130(a)(5)). A date more than a year old is easy to spot from outside — and a policy that lists categories of trackers the site no longer uses, or misses new ones, is out of date whatever its date says.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA) · CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA)