Ccpa Privacy Notice Template for the United States

A CCPA Privacy Notice is a critical legal document that businesses operating in California must provide to inform consumers about their data collection and privacy practices. Under the California Consumer Privacy Act and its amendment, the California Privacy Rights Act, this notice serves as your primary communication tool to meet transparency requirements and help consumers understand their privacy rights.

When do you need this document?

You need a CCPA Privacy Notice if your business meets any of the following thresholds: annual gross revenues exceeding $25 million, buying, selling, or sharing personal information of 100,000 or more consumers or households annually, or deriving 50% or more of your annual revenue from selling or sharing personal information. This applies whether you're an e-commerce retailer collecting customer data, a healthcare provider processing patient information, a financial services company handling client records, or a technology platform gathering user analytics. The notice is mandatory regardless of your business size if you meet these criteria and collect personal information from California residents.

Key legal considerations

Your CCPA Privacy Notice must include specific mandatory disclosures about the categories of personal information you collect, the sources of collection, your business purposes for processing data, and the categories of third parties with whom you share information. You must clearly explain consumer rights, including the right to know what personal information is collected, the right to delete personal information, the right to opt-out of the sale or sharing of personal information, and the right to non-discrimination for exercising privacy rights. The notice must describe your methods for submitting requests and your verification processes. Additionally, you must disclose any retention periods for different categories of personal information and provide contact information for privacy inquiries. Failure to maintain an adequate privacy notice can result in enforcement actions and significant penalties.

Legal requirements in the United States

Under California law, your privacy notice must be posted conspicuously on your website homepage and anywhere you collect personal information online. The document must be written in plain language and available in all languages in which you provide contracts or other information to consumers. You're required to update the notice at least once every 12 months and whenever you make material changes to your privacy practices. The California Privacy Protection Agency has enforcement authority and can impose penalties of up to $7,500 per intentional violation. Your notice must also comply with the Federal Trade Commission Act's prohibition against deceptive practices, meaning you must actually follow the practices described in your notice. If you operate websites directed to children under 13, you must also ensure compliance with the Children's Online Privacy Protection Act requirements.