CCPA Privacy Policy Example

The CCPA applies to any for-profit entity doing business in California that either:

• processes (buy, sell, receive, share) personally identifiable information of at least 50k Californians per year,
• has annual gross revenues of at least $ 25 million, or
• makes over 50% of its yearly revenue from sharing consumers’ personal information with third parties

Please note that your business could be based anywhere : as long as your services are accessible in California, you could be covered by the CCPA and have to adhere to its requirements.

Under the CCPA, businesses must include specific disclosures in their privacy policies. These disclosures include descriptions of:

• consumer rights,
• processing partners,
• purposes,
• sources and more.

This information must be complete, up-to-date and easily accessible throughout your website / app.

In order to be compliant, your policy must at the very least contain:

• the categories of personal information that you’ve collected, sold or shared in the past 12 months;
• the categories of third parties that you have and / or may share the information with;
• the categories of sources from which you collect this information;
• the business / commercial purpose for processing the information;
• the applicable consumers’ rights and how they can be exercised.

If you already have a privacy policy, make sure you have or add these information.

• Consumers are given the right to sue businesses that violate the law. You may have to pay damages of up to $ 750 (or cover actual losses if greater) for each affected consumer.
• If you unintentionally violate the CCPA, you can be fined up to $ 2,500 for each violation.
• If you intentionally violate the CCPA, you can be fined up to $ 7,500 for each violation.

While these fines might not seem like a lot when compared to the GDPR, do consider that these fines apply per individual violation and per consumer.