Notice at collection

This is the notice that must be provided to consumers at the point where PI is going to be collected. It must contain the following information (or a link to the section of the business’s privacy policy that contains the same information):

• A list of categories of PI that is collected about consumers;

• For each of the categories, the business or commercial purpose for which the information will be used;

• If the business sells PI, a link titled either “Do Not Sell My Personal Information” or “Do Not Sell My Info.” (In the case of offline notices, provide the web address for the webpage to which the “Do Not Sell” link directs consumers); and

• A link to the business’s privacy policy. (In the case of offline notices, provide the web address of the business’s privacy policy).

Notice of right to opt-out of sale of PI

A business that “sells” PI (as defined in the CCPA) must post the notice of right to opt out on the web page to which the consumer is directed after clicking the “Do Not Sell” link on the download or landing page of a mobile application. It must contain the following information (or a link to the section of the business’s privacy policy that contains the same information):

• A description of the opt-out right;

• The web form by which the consumer can submit their request to opt out online or, if the business does not operate a website, the offline method by which the consumer can submit an opt-out request;

• Instructions for any other method by which to request to opt out;

• Any proof required when a consumer uses an authorized agent to exercise the opt-out right—or, in the case of a printed form containing the notice, a web page, online location, or URL where consumers can get information about authorized agents (the possibility of consumers exercising rights through an authorized agent is mentioned several times in the draft regulations; companies need to anticipate that this may be common); and

• A link to the privacy policy (or, if offline, the URL of the web page where consumers can access the privacy policy).

Notice of financial incentive

If the business offers a financial incentive or price or service difference (a “financial incentive”) in connection with obtaining PI, the business must post a notice with the following information:

• A “succinct” summary of the financial incentive;

• A description of the material terms, including the categories of PI that are implicated;

• How the consumer can opt in;

• The consumer’s right to withdraw at any time and how to exercise that right; and

• An explanation of why the financial incentive is permitted under the CCPA, including a good faith estimate of the value of the consumer’s data and how that value was calculated.

Privacy policy

According to the draft regulations, the purpose of the privacy policy is “to provide the consumer with a comprehensive description of a business’s online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of consumers regarding their personal information.” In addition to the easy-to-read and accessible requirements for all CCPA-required notices, the privacy policy must:

• Be available in an additional format that a consumer can print out as a separate document, and

• Be posted online through a conspicuous link using the word “privacy” on the business’s website homepage or on the download or landing page of a mobile application. (If the business does not operate a website, it must make the privacy policy conspicuously available to consumers).

With regard to content, the draft regulations provide a detailed explanation regarding how the privacy policy must:

• Advise consumers about their CCPA rights;

• Provide instructions about how consumers can exercise their rights and describe the verification process;

• List the categories of PI the business has collected in the preceding 12 months and, for each category, provide:

  • The business or commercial purpose for collecting the PI.

  • The “categories of third parties” with whom the PI is shared. According to the draft regulations, categories of third parties means “types of entities that do not collect personal information directly from consumers including but not limited to advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and consumer data resellers.”

• State whether or not the business sells the PI of minors under 16 years old without affirmative authorization;

• State whether the business has disclosed or sold any PI to third parties for a business or commercial purpose in the preceding 12 months and, if PI has been sold or disclosed, list the categories of PI disclosed or sold;

• Explain how a consumer can designate an authorized agent to make CCPA requests on the consumer’s behalf;

• Provide a contact for questions or concerns using a method that reflects the manner in which the business primarily interacts with consumers;

• Identify the date the privacy policy was last updated; and

• If the business annually buys, receives, sells, or shares the PI of 4 million or more consumers, disclose certain metrics regarding the number of CCPA requests and the median number of days that it took the business to respond.