Post-graduate law degree, CIPP/E from the International Association of Privacy Professionals (IAPP). Privacy and Data Protection Research Writer at TermsFeed.
On this page
- 1. CCPA (CPRA): A Brief Introduction
- 1.1. Which Businesses are Covered by the CCPA (CPRA)?
- 1.1.1. What is "Doing Business in California?"
- 1.1.2. What is a "Consumer?"
- 1.1.3. What is "Personal Information?"
- 2. What are the CCPA (CPRA) Consumer Notices?
- 2.1. Notice at Collection
- 2.2.1. The Right to Know
- 2.2.2. The Right to Delete
- 2.2.3. The Right to Opt Out
- 2.2.4. The Right to Non-Discrimination
- 2.2.5. Authorized Agent
- 2.2.6. Contact Information
- 2.2.7. Date of Last Update
- 2.3. Notice of Financial Incentive
- 2.4. Additional Requirements
- 3. Summary
The California Consumer Privacy Act (CCPA/CPRA) requires businesses under its scope to provide a number of notices addressing a variety of issues.
In this article, we're going to look at what the CCPA (CPRA) specifically requires, how businesses are providing CCPA-compliant notice and how you can create your own notices to stay compliant with the CCPA (CPRA).
Note that the CCPA was updated, amended and expanded by the CPRA. This expansion took effect on Jan. 1 2023.
At Step 1, select the Website option or App option or both.
Answer some questions about your website or app.
Answer some questions about your business.
CCPA (CPRA): A Brief Introduction
Since the CCPA passed in 2018, businesses have been working hard to provide appropriate notice to consumers regarding the collection and use of their personal information.
But the definition of "consumer" in the current CCPA (CPRA) is broader than many people realize. Any California resident can be a consumer: not just the public (e.g. your customers and users of your website), but also your employees.
Let's look more specifically at this and at some other relvant terminology under the CCPA (CPRA).
Which Businesses are Covered by the CCPA (CPRA)?
The CCPA (CPRA) applies if a business is "doing business in California" (regardless of where the business itself is located), and one or more of the following characteristics apply to it:
- It has annual gross revenues of $25 million or more
- It buys, sells, shares for commercial purposes, or receives for commercial purposes, the personal information of more than 100,000 California consumers, devices, or households per year
- It derives at least 50 percent of its annual revenues from the selling or sharing of consumers' personal information
What is "Doing Business in California?"
The CCPA (CPRA) applies to businesses all over the world. If you want to "do business" in California, and you fall under the CCPA/CPRA's scope, you must comply with the act.
Doing business in California might include the following:
- Selling goods or services to California consumers
- Hiring California consumers as contractors or employees
- Buying, selling, sharing, or receiving the personal information of California consumers
What is a "Consumer?"
The CCPA (CPRA) defines a consumer as a "natural person" (i.e. not a "legal person" such as a corporation) who is a California resident. The CCPA (CPRA) takes its definition of "California resident" from another law, 18 CCR § 17014.
This includes not only your customers but any California resident whose personal information your business collects, including employees.
What is "Personal Information?"
Different privacy laws define "personal information" in different ways. The CCPA (CPRA) defines personal information more broadly than any other U.S. privacy law. Here's the definition of personal information in the CCPA (CPRA):
The CCPA gives many examples of personal information, including:
- Full name
- IP address
- Browsing history
Try not to think of personal information only as information that describes or identifies a consumer. If a piece of information could be reasonably linked to a consumer, it's personal information.
The CPRA amendment introduces the concept of sensitive personal information under the CCPA.
What are the CCPA (CPRA) Consumer Notices?
Under the CCPA (CPRA), consumers have a "right to notice." This means they have the right to a variety of information, including information about what personal information your business collects, uses, shares, and sells, and what their other rights are regarding this.
The following principles apply when you are creating your consumer notices:
- Use clear and plain language.
- Make your notices clear and conspicuous, even on small screens.
- Use whatever language you normally use to communicate with consumers.
- Provide your notices in alternative formats for consumers with disabilities.
- If you're collecting personal information on paper, you must provide a hard copy of your notices.
Let's look at what notices you must provide under the CCPA (CPRA).
Notice at Collection
You must ensure that your notice at collection is presented to consumers before you collect their personal information.
Your Notice at Collection must:
- Identify the types of personal information you're collecting
- Explain the business or commercial purposes for which you collect personal information
- How long you plan to retain this information for
- Provide a link to your "Do Not Sell My Personal Information" page (if you have one)
Here's an excerpt from a Notice at Collection created by Central Valley Community Bank:
The table shows a list of categories of personal information that the business collects, together with its intended uses of the personal information.
Here's an excerpt from Master and Dynamic's notice at collection:
The same applies for employee notices.
Here's an example of a Notice at Collection that Pyrotek provides to job applicants:
We've broken this requirement down into seven sections and provided some examples from businesses that are meeting these requirements.
The Right to Know
- Explain the right to know, including that consumers may ask what personal information you collect, use, disclose for business purposes, and/or sell.
- Explain how consumers can make a request. If you provide a web form that enables them to make a request, provide a link to this form.
- Explain your process for verifying a consumer's identity, including any information you will ask them for.
Here's how Technicolor's CCPA Privacy Notice explains the right to know:
You'll also need to:
Explain how you have processed personal information over the past 12 months:
- Provide a list of each category of personal information you have collected.
For each category of personal information on the list, explain:
- Where you obtained it (the "categories of sources")
- Your business or commercial purposes for collecting it
- Any third parties with whom you share it
Here's an example from Weatherbit, disclosing the categories of personal information the business has collected over the past 12 months:
Explain how you have disclosed and/or sold personal information over the past 12 months:
- Disclose whether you have sold or disclosed personal information for business purposes.
- Provide a list of each category of personal information you have sold or disclosed for business purposes.
- State whether your business has "actual knowledge" of having sold the personal information of minors.
The Right to Delete
- Explain the right to delete: That consumers may request that you delete personal information you have collected about them.
- Explain how consumers can make a request under the right to delete. If you provide a web form that enables them to make a request, provide a link to this form.
- Explain your process for verifying a consumer's identity, including any information you will ask them for.
Here's how Oreck covers the first two points above:
The Right to Opt Out
You must provide Notice of the Right to Opt Out (also known as a "Do Not Sell My Personal Information" page) if you sell consumers' personal information.
Here's how Thomson Reuters does this:
You'll need to do the following to facilitate the right to opt out:
- Explain the right to opt out
- Provide an opt out form
- Inform consumers of any alternative opt-out methods
- Describe any verification requirements you have for authorized agents
You should provide Notice of the Right to Opt Out via a clear and conspicuous link that reads "Do Not Sell My Personal Information" or "Do Not Sell My Info."
Here's an excerpt from a Notice of the Right to Opt Out from Publisher's Clearing House (PCH):
Note that PCH allows consumers to provide their account number, but does not require them to do so. This is good. You must not require consumers to create an account with your business in order for them to be able to exercise their CCPA (CPRA) rights.
The Right to Non-Discrimination
Explain the right to non-discrimination.
Here's how CooperSurgical does this:
Note that you may not need to go into this much detail to comply with the CCPA (CPRA). In particular, the section about financial incentive schemes (in the red box) is not required unless you operate such a scheme.
Explain how an authorized agent can make a CCPA (CPRA) request on a consumer's behalf.
Here's how Ironwood Pharmaceuticals does this:
Note how the business uses clear and straightforward language in its explanation.
Provide contact details via which a consumer can request further information.
Here's an example from eHealthInsurance:
Note how this business provides a broad range of contact options for consumers.
Date of Last Update
Here's how Salt Edge does this:
Notice of Financial Incentive
You only need to provide a Notice of Financial Incentive if you operate a financial incentive scheme.
The CCPA (CPRA) allows a business to offer consumers discounts or other benefits in exchange for their personal information, so long as the business meets certain conditions.
Your Notice of Financial Incentive must:
- Summarize the scheme
- Provide the terms of the scheme and the categories of personal information you collect
- Explain how to opt in
- Explain how to withdraw
- An estimate of the value of participating consumers' personal information
- An explanation of how you calculated this value
Here's an extract of a Notice of Financial Incentive from Prodege:
In this excerpt, Prodege sets out the terms of its scheme and explains how consumers can opt in and opt out.
For more information about this notice, please see our "CCPA (CPRA) Notice of Financial Incentives" article.
You only need to provide this information if your business buys, sells, receives, and/or shares the personal information of more than 4 million consumers per year.
With respect to the past 12 months, disclose:
- The number of "right to know" requests you received
- The number of "right to delete" requests you received
- The number of "right to opt out" requests you received
For each item above, disclose:
- How many requests you fulfilled (in whole or in part), how many requests you rejected, and your average response time (the median number of days)
To fulfill the right to notice, all businesses covered by the CCPA (CPRA) must provide up to four types of consumer notice:
- Notice at Collection
- Notice of the Right to Opt Out
- Notice of Financial Incentive
Each of these types of notices have more nuanced requirements, but the key is being transparent and disclosing your privacy practices as well as the rights that consumers have.