What to account for
Check whether the law applies
CPPA lists for-profit businesses operating in California meeting any threshold: $26.625 million gross revenue in the preceding calendar year, 100,000 residents/households whose information is bought, sold or shared, or 50% revenue from sale/sharing. Exemptions and related-entity rules need review.
Notice at collection and policy
The notice at collection explains categories and purposes at or before collection and links to the policy. The policy explains practices and available consumer rights.
Put rights into operation
The CCPA includes rights to know, delete and correct, plus sale/sharing opt-out and limits on certain sensitive-information uses, subject to statutory conditions and exceptions.
Common mistakes to check
No money changed hands, so no sharing
CCPA sharing includes cross-context behavioral advertising, whether or not money changes hands. Review actual transfers instead of inferring legal status from a cookie name.
A link without an effective opt-out
Covered businesses must honor qualifying opt-out signals such as Global Privacy Control. Displaying an opt-out link does not by itself stop sale or sharing.
Your review checklist
Our suggested review process. The linked requirements above explain the platform or legal basis.
Confirm scope and inventory
Ask the business owner about coverage, categories, sources, purposes, recipients, retention and request channels. Include employee, offline and backend data where relevant.
Review transfers explicitly
Use the scan as evidence of observed vendors. Decide sale/sharing and service-provider roles with the contracts and actual uses; do not label every vendor automatically.
Test notices and requests
Review collection points and the policy draft together. Test GPC and manual opt-out, then route a rights request through the actual process. Keep the result and review date.
Example
Fictional shop: Harbor Outfitters
Assume the business confirms CCPA coverage and a retargeting integration. The scan observes its request; a reviewer uses the advertising contract and configuration to assess sharing.
From a finding to a decision
The owner documents recipients, updates the draft and connects the opt-out choice to the integration. A test browser with GPC then checks actual requests. Finding the pixel alone proves none of these decisions.
Questions before publishing
Is CPRA a separate policy?
CPRA amended the CCPA. Review the current requirements together rather than treating an old CCPA template as sufficient.
How often should the policy be reviewed?
The CCPA requires updating specified privacy-policy disclosures at least once every 12 months. Operational changes also warrant checking whether the published information remains accurate.
What do I gather before drafting?
Bring your data inventory, vendor contracts, retention decisions and request process. Note any open questions for your business and legal reviewers.
Source review and changes
First edition: platform requirements, implementation checks and fictional worked example. Sources reviewed on the date above; verify changes before relying on them.