Cal. Code Regs. Tit. 11, § 7011 - Privacy Policy
(a)
The purpose of the privacy policy is to provide consumers with a comprehensive
description of a business's online and offline information practices. It shall
also inform consumers about the rights they have regarding their personal
information and provide any information necessary for them to exercise those
rights.
(b) The privacy policy
shall comply with section
7003, subsections (a) and
(b).
(c) The privacy policy shall
be available in a format that allows a consumer to print it out as a
document.
(d) The privacy policy
shall be posted online and accessible through a conspicuous link that complies
with section
7003, subsections (c) and (d),
using the word "privacy" on the business's website homepage(s) or on the
download or landing page of a mobile application. If the business has a
California-specific description of consumers' privacy rights on its website,
then the privacy policy shall be included in that description. A business that
does not operate a website shall make the privacy policy conspicuously
available to consumers. A mobile application may include a link to the privacy
policy in the application's settings menu.
(e) The privacy policy shall include the
following information:
(1) A comprehensive
description of the business's online and offline information practices, which
includes the following:
(A) Identification of
the categories of personal information the business has collected about
consumers in the preceding 12 months. The categories shall be described using
the specific terms set forth in Civil Code section
1798.140,
subdivisions (v)(1)(A) to (K) and (ae)(1) to (2). To the extent that the
business has discretion in its description, the business shall describe the
category in a manner that provides consumers a meaningful understanding of the
information being collected.
(B)
Identification of the categories of sources from which the personal information
is collected.
(C) Identification of
the specific business or commercial purpose for collecting personal information
from consumers. The purpose shall be described in a manner that provides
consumers a meaningful understanding of why the information is
collected.
(D) Identification of
the categories of personal information, if any, that the business has sold or
shared to third parties in the preceding 12 months. If the business has not
sold or shared consumers' personal information in the preceding 12 months, the
business shall disclose that fact.
(E) For each category of personal information
identified in subsection (e)(1)(D), the categories of third parties to whom the
information was sold or shared.
(F)
Identification of the specific business or commercial purpose for selling or
sharing consumers' personal information. The purpose shall be described in a
manner that provides consumers a meaningful understanding of why the
information is sold or shared.
(G)
A statement regarding whether the business has actual knowledge that it sells
or shares the personal information of consumers under 16 years of
age.
(H) Identification of the
categories of personal information, if any, that the business has disclosed for
a business purpose to third parties in the preceding 12 months. If the business
has not disclosed consumers' personal information for a business purpose in the
preceding 12 months, the business shall disclose that fact.
(I) For each category of personal information
identified in subsection (e)(1)(H), the categories of third parties to whom the
information was disclosed.
(J)
Identification of the specific business or commercial purpose for disclosing
the consumer's personal information. The purpose shall be described in a manner
that provides consumers a meaningful understanding of why the information is
disclosed.
(K) A statement
regarding whether the business uses or discloses sensitive personal information
for purposes other than those specified in section
7027, subsection (m).
(2) An explanation of the rights
that the CCPA confers on consumers regarding their personal information, which
includes all of the following:
(A) The right
to know what personal information the business has collected about the
consumer, including the categories of personal information, the categories of
sources from which the personal information is collected, the business or
commercial purpose for collecting, selling, or sharing personal information,
the categories of third parties to whom the business discloses personal
information, and the specific pieces of personal information the business has
collected about the consumer.
(B)
The right to delete personal information that the business has collected from
the consumer, subject to certain exceptions.
(C) The right to correct inaccurate personal
information that a business maintains about a consumer.
(D) If the business sells or shares personal
information, the right to opt-out of the sale or sharing of their personal
information by the business.
(E) If
the business uses or discloses sensitive personal information for reasons other
than those set forth in section
7027, subsection (m), the right to
limit the use or disclosure of sensitive personal information by the
business.
(F) The right not to
receive discriminatory treatment by the business for the exercise of privacy
rights conferred by the CCPA, including an employee's, applicant's, or
independent contractor's right not to be retaliated against for the exercise of
their CCPA rights.
(3)
An explanation of how consumers can exercise their CCPA rights and what
consumers can expect from that process, which includes all of the following:
(A) An explanation of the methods by which
the consumer can exercise their CCPA rights.
(B) Instructions for submitting a request
under the CCPA, including any links to an online request form or portal for
making such a request, if offered by the business.
(C) If the business sells or shares personal
information, and is required to provide a Notice of Right to Opt-out of
Sale/Sharing, the contents of the Notice of Right to Opt-out of Sale/Sharing or
a link to that notice in accordance with section
7013, subsection (f).
(D) If the business uses or discloses
sensitive personal information for purposes other than those specified in
section 7027, subsection (m), and is
required to provide a Notice of Right to Limit, the contents of the Notice of
Right to Limit or a link to that notice in accordance with section
7014, subsection (f).
(E) A general description of the process the
business uses to verify a consumer request to know, request to delete, and
request to correct, when applicable, including any information the consumer
must provide.
(F) Explanation of
how an opt-out preference signal will be processed for the consumer
(i.e., whether the signal applies to the device, browser,
consumer account, and/or offline sales, and in what circumstances) and how the
consumer can use an opt-out preference signal.
(G) If the business processes opt-out
preference signals in a frictionless manner, information on how consumers can
implement opt-out preference signals for the business to process in a
frictionless manner.
(H)
Instructions on how an authorized agent can make a request under the CCPA on
the consumer's behalf.
(I) If the
business has actual knowledge that it sells the personal information of
consumers under 16 years of age, a description of the processes required by
sections 7070 and
7071.
(J) A contact for questions or concerns about
the business's privacy policies and information practices using a method
reflecting the manner in which the business primarily interacts with the
consumer.
(4) Date the
privacy policy was last updated.
Notes
2. Amendment of section and NOTE filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section 11343.4(b)(3) (Register 2023, No. 13).
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.121, 1798.125, 1798.130 and 1798.135, Civil Code.
2. Amendment of section and NOTE filed 3-29-2023; operative
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.