California Privacy Policy
California has two privacy policy laws. The California Online Privacy Protection Act applies to almost any commercial website that collects personal information from Californians, whatever the size of the business. The California Consumer Privacy Act adds detailed content, annual updates and opt-out links for businesses over its thresholds.
What California law does to this document
Who the CCPA covers
The comprehensive privacy law applies to a for-profit business that does business in California and meets one of three thresholds. The first is annual gross revenue above $25,000,000 as adjusted for inflation, which has been $26,625,000 since January 1, 2025. The second is buying, selling or sharing the personal information of 100,000 or more consumers or households a year. The third is earning 50 percent or more of annual revenue from selling or sharing personal information.
Cal. Civ. Code § 1798.140(d)What the policy must say, and how often
A covered business must describe consumers' rights and the methods for submitting requests, and it must offer at least two methods unless it operates exclusively online. The policy must list the categories of personal information collected, sold, shared and disclosed in the preceding 12 months. It must be updated at least once every 12 months. At or before collection, the business must also disclose how long it intends to keep each category of information or the criteria used to decide.
Cal. Civ. Code §§ 1798.100(a), 1798.130(a)(1), (a)(5)Opt-out links, signals and minors
A business that sells or shares personal information must post a clear and conspicuous homepage link titled "Do Not Sell or Share My Personal Information." If it uses sensitive personal information beyond the permitted purposes, it must also post a link titled "Limit the Use of My Sensitive Personal Information." The links are not required if the business honors an opt-out preference signal that meets the regulations. A business with actual knowledge that a consumer is under 16 may not sell or share that consumer's information without opt-in consent, given by a parent or guardian for a child under 13.
Cal. Civ. Code §§ 1798.120(c), 1798.135CalOPPA applies regardless of size
An operator of a commercial website or online service that collects personally identifiable information about California consumers must conspicuously post a privacy policy. The policy must identify the categories of information collected and the categories of third parties it is shared with. It must also state its effective date and, if the operator tracks consumers over time and across third-party sites, how it responds to browser "do not track" signals. An operator is in violation only if it fails to post the policy within 30 days after being notified of noncompliance.
Cal. Bus. & Prof. Code § 22575Automated decisionmaking rules
California Privacy Protection Agency regulations on automated decisionmaking technology, risk assessments and cybersecurity audits took effect on January 1, 2026. A business that uses automated decisionmaking technology for significant decisions must comply with those requirements starting January 1, 2027. The generator's policy asks whether the business uses automated decision-making that produces legal or similarly significant effects.
Cal. Civ. Code § 1798.185 (rulemaking authority); California Privacy Protection Agency regulations approved September 22, 2025Fines and data breach damages
The administrative fine is up to $2,663 for each violation and up to $7,988 for each intentional violation or violation involving a consumer the business knows is under 16. After a data breach caused by a failure to maintain reasonable security, a consumer may recover $107 to $799 per incident or actual damages, whichever is greater. These figures took effect on January 1, 2025 and are adjusted for inflation every odd-numbered year.
Cal. Civ. Code §§ 1798.150(a), 1798.155(a), 1798.199.95(d)Where people go wrong in California
- Assuming a small business needs no privacy policy because it is under the CCPA thresholds, when Business and Professions Code section 22575 applies to any commercial site collecting personal information from Californians.
- Posting a policy once and leaving it, when Civil Code section 1798.130 requires an update at least once every 12 months.
- Publishing the generator's policy without a statement on browser do-not-track signals, which Business and Professions Code section 22575 requires of an operator that tracks consumers across third-party sites and which the draft, though it addresses the Global Privacy Control, does not include.
How the generator works
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Answer a short interview and the draft assembles as you go, with California already set as the governing state. Download it as PDF or Word. No fee. No account.