California’s Consumer Privacy Act (CCPA) was enforceable from July 2020. Its successor, the California Privacy Rights Act (CPRA), took effect on January 1, 2023 with full enforcement beginning July 1, 2023. Today, in 2026, the compliance expectations are well established, the California Privacy Protection Agency (CPPA) is active, and businesses that have not properly updated their privacy policies are operating with real regulatory and litigation exposure.
If your privacy policy was last updated before 2023, or if it was drafted from a generic template without accounting for your specific data practices, it almost certainly does not meet current requirements. Here is a practical breakdown of what your privacy policy must include.
1. What Businesses the CCPA and CPRA Cover
The CCPA and CPRA apply to for-profit businesses that collect personal information from California consumers and meet at least one of the following thresholds:
- Annual gross revenues exceeding $25 million
- Annually buys, sells, receives, or shares for commercial purposes the personal information of 100,000 or more consumers or households
- Derives 50% or more of annual revenues from selling or sharing consumers’ personal information
If your business operates a website, app, or platform that attracts California users, and you fall within these thresholds, the law applies to your privacy practices regardless of where your company is headquartered.
Service providers and contractors who process personal information on behalf of covered businesses also have specific obligations under the CPRA, including limitations on how they can use the data they process.
2. Required Disclosures in Your Privacy Policy
The CCPA and CPRA require businesses to provide consumers with a privacy policy that is reasonably accessible, written in plain language, and updated at least every 12 months. The specific disclosures required include:
Categories of Personal Information Collected
Your privacy policy must identify the categories of personal information you collect, using the categories defined in California Civil Code Section 1798.140. These categories include identifiers like names and email addresses, commercial information, internet and electronic network activity, geolocation data, and sensitive personal information such as social security numbers, financial account numbers, health data, and precise geolocation.
A generic statement that you “collect information you provide” is not compliant. The policy must identify the specific categories of data you actually collect.
Business or Commercial Purpose for Collection
For each category of personal information collected, your policy must explain the business or commercial purpose for which it is collected. If you collect email addresses for marketing campaigns, that purpose should be stated. If you collect device identifiers for analytics, that purpose should be stated.
Categories of Third Parties With Whom You Share Information
You must disclose the categories of third parties with whom you share personal information, and for what purpose. That includes advertising networks, analytics providers, payment processors, cloud storage providers, and any other entity that receives consumer data from your platform.
How to Submit Consumer Rights Requests
Your privacy policy must explain how California consumers can exercise their rights under the CCPA and CPRA. This includes:
- The right to know what personal information you have collected about them
- The right to delete personal information in your records
- The right to correct inaccurate personal information (added by CPRA)
- The right to opt out of the sale or sharing of personal information
- The right to limit use of sensitive personal information (added by CPRA)
- The right to non-discrimination for exercising these rights
Each of these rights requires a functional mechanism for consumers to submit requests and a defined process for responding within the timeframes the law specifies (45 days for most requests, with a 45-day extension available).
3. The CPRA’s Sensitive Personal Information Category
The CPRA created a new category of sensitive personal information (SPI) with heightened protection requirements. Sensitive personal information includes:
- Social security, driver’s license, state ID, and passport numbers
- Financial account information including login credentials
- Precise geolocation data
- Racial or ethnic origin, religious or philosophical beliefs, and union membership
- Contents of mail, email, and text messages unless you are the intended recipient
- Genetic data
- Biometric information processed to identify a person
- Health information
- Sexual orientation or sex life
If your business collects any of these categories, you must provide consumers with the right to limit the use and disclosure of their SPI to what is reasonably necessary to perform the service they requested. Your privacy policy must disclose that you collect SPI, what categories you collect, and how consumers can exercise the limit-use right.
4. Data Retention Disclosures
The CPRA added a new disclosure requirement that many businesses have not yet addressed: your privacy policy must now state how long you retain each category of personal information, or if specifying a retention period is not possible, the criteria you use to determine retention periods.
This is a significant addition. Prior to the CPRA, retention schedules were a compliance best practice but not a disclosure requirement. Now, a privacy policy that says nothing about how long you keep consumer data is non-compliant.
Your retention policy should be defensible and proportionate to the purpose for which the data was collected. Retaining personal information indefinitely “just in case” is both a compliance risk and a data minimization issue under multiple regulatory frameworks, including GDPR if you have European users.
5. Opt-Out Links and the “Do Not Sell or Share My Personal Information” Requirement
If your business sells or shares personal information for cross-context behavioral advertising, you must provide a clear and conspicuous link on your website labeled “Do Not Sell or Share My Personal Information.” This link is separate from your privacy policy itself and must be accessible from your homepage.
The CPRA expanded the opt-out right from “selling” personal information, which was the CCPA standard, to also cover “sharing” personal information for the purpose of cross-context behavioral advertising, even when no money changes hands. If you use third-party advertising pixels, retargeting tools, or behavioral advertising platforms that receive consumer data from your site, you are likely sharing personal information in the CPRA’s sense, and the opt-out link is required.
Under California regulations, you can implement a Global Privacy Control (GPC) signal as an alternative mechanism, but that does not remove the obligation to provide an opt-out link for users who do not use GPC.
A privacy policy lawyer can review your advertising and analytics setup to determine whether you are selling or sharing personal information under the CPRA definition and what disclosures and mechanisms your website needs.
6. How CPRA Enforcement Has Changed the Compliance Landscape
The California Privacy Protection Agency became fully operational in 2023 and has pursued enforcement actions covering a range of violations, including failure to honor opt-out requests, inaccurate privacy policy disclosures, and failure to implement required data subject rights mechanisms.
Enforcement actions under the CCPA carry civil penalties of up to $2,500 per unintentional violation and $7,500 per intentional violation. Each consumer whose rights are violated can represent a separate violation. For a business with tens of thousands of California users, a systematic failure to honor deletion requests or provide compliant opt-out mechanisms can result in exposure that is disproportionate to the apparent simplicity of the underlying requirement.
Privacy class action litigation has also increased. The CPRA’s private right of action allows consumers to sue for data breaches involving their personal information if the business failed to implement reasonable security procedures. Businesses that store significant amounts of consumer data without proper security measures and without a compliant privacy policy face both regulatory and litigation exposure.
7. Steps to Get Your Privacy Policy in Compliance
Getting your privacy policy compliant with the CCPA and CPRA in 2026 requires an audit of your actual data practices, not just a review of your current policy language. Here is a practical framework:
First, conduct a data inventory. Document what categories of personal information you collect, the source of each category, what you do with it, and who you share it with. Your policy disclosures must reflect your actual practices.
Second, update the policy to include all required disclosures. Ensure you have addressed categories collected, purposes for collection, third-party sharing, consumer rights and how to exercise them, SPI disclosures, and retention periods.
Third, implement functional rights request mechanisms. You need a working process to receive, verify, and respond to requests within statutory timeframes. A policy that describes rights but has no process for honoring them creates compliance gaps.
Fourth, review your advertising and analytics setup for sharing obligations. If you use behavioral advertising platforms or third-party analytics tools, assess whether you are sharing personal information and implement the required opt-out mechanism.
Fifth, set a policy update schedule. Your privacy policy must be reviewed and updated at least annually. Assign that responsibility internally and make it a recurring compliance task.
Working with a privacy policy attorney ensures your policy reflects your actual data practices, uses legally compliant language for the required disclosures, and gives you a defensible position in the event of an enforcement inquiry or litigation.
Frequently Asked Questions
Does the CCPA apply to businesses outside California?
Yes. The CCPA and CPRA apply to any for-profit business that collects personal information from California consumers and meets the applicable revenue or data volume thresholds, regardless of where the business is located. A New York-based SaaS company that collects data from California users is subject to the law.
What should a privacy policy include for CCPA and CPRA compliance?
A compliant policy must include: categories of personal information collected, business purposes for collection, categories of third parties with whom information is shared, a description of each consumer right and how to exercise it, disclosures about sensitive personal information if collected, and your data retention practices or criteria.
What is the difference between CCPA and CPRA?
The CPRA amended and expanded the CCPA. Key additions include: a new category of sensitive personal information with heightened protections, the right to correct inaccurate personal information, the right to limit use of sensitive personal information, data retention disclosure requirements, and the creation of the California Privacy Protection Agency as a dedicated enforcement authority.
What happens if a business does not comply with the CCPA?
The California Attorney General can seek civil penalties of up to $2,500 per unintentional violation and $7,500 per intentional violation. The CPPA can also pursue enforcement actions independently. Additionally, the CPRA allows consumers to bring private lawsuits for certain data breaches where the business failed to implement reasonable security measures.
How often do I need to update my privacy policy?
The CCPA and CPRA require that your privacy policy be reviewed and updated at least every 12 months. The policy should also be updated any time your data practices materially change, such as when you add a new data category, change your advertising setup, or add a new integration that receives consumer data.
CCPA and CPRA compliance is not a project you complete once and set aside. Your data practices evolve, the regulations continue to develop through CPPA rulemaking, and new state privacy laws in Virginia, Colorado, Connecticut, Texas, and elsewhere are creating a complex patchwork of requirements that apply to businesses operating nationally.
If your privacy policy has not been reviewed by a privacy policy lawyer since the CPRA came into full effect, that review is overdue. Contact Hansen Tong at TOSLawyer.com to get your privacy policy aligned with current requirements.