Under the CCPA as amended by the CPRA you need a privacy policy, a notice at collection, opt-out and limit mechanisms where relevant, a documented way for consumers to submit requests, an internal procedure for answering them, and vendor terms. Public notices must match what you actually do with personal information.
Public documents
Privacy policy. The Attorney General describes it as a written statement of your online and offline practices for collecting, using, sharing and selling personal information. It must explain consumer rights and how to exercise them: know, delete, opt out of sale or sharing, correct, limit use of sensitive personal information, and non-discrimination. Link it from your homepage footer and from your app settings or listing.
Notice at collection. Provided at or before the point of collection. It lists the categories of personal information collected and the purposes. If you sell or share personal information, it includes a Do Not Sell or Share link. It also links to your privacy policy. Place it on forms, checkout pages and app sign-up screens.
Do Not Sell or Share My Personal Information link. Required for businesses that sell or share. Per the AG, consumers cannot be required to create an account to use it, and you should not require identity verification for opt-outs, though you may ask basic questions to find the right record. Honour opt-out preference signals such as Global Privacy Control.
Limit the Use of My Sensitive Personal Information. If you use sensitive personal information beyond the limited purposes the law allows, offer this mechanism. Sensitive categories include government identifiers, account credentials, precise geolocation, contents of messages, genetic and biometric data and health information.
Notice of financial incentive. If you offer incentives in exchange for personal information, check the regulations for the notice you need. We did not review that text in detail.
Internal documents
Data inventory and record of processing. Categories, sources, purposes, recipients, retention and sensitive data flags. It is the factual base for every notice.
Consumer request procedure. Intake channels (the AG says at least two methods for requests to know, including a toll-free number and a website method, with an email-only exception for businesses that operate exclusively online), identity verification rules, response timelines of 45 calendar days extendable by 45, opt-out handling within 15 business days at most, deletion steps across systems and vendors, and an escalation path.
Request log template. Date, type, channel, verification, outcome, deadline and notes.
Vendor and contractor terms. Written terms with each service provider or contractor limiting how they use personal information. Check current regulations for required clauses and have counsel review.
Retention schedule. How long each category is kept and why.
Security and incident procedures. Consumers can sue after certain breaches if reasonable security was not maintained, so keep your security policies current.
Training record. Who has been trained to handle requests.
Risk assessment and cybersecurity audit records, where applicable. CalPrivacy adopted regulations on these and on automated decisionmaking technology in 2025, effective 1 January 2026 according to its site. Check which duties apply to you.
Making documents match practice
A privacy policy that says you do not sell data while your ad tags share identifiers is a problem. Review each notice against the data inventory and your site tags whenever marketing or engineering adds a tool.
What to do
- Build the data inventory and confirm sale or sharing status with marketing and engineering.
- Draft the privacy policy and notice at collection from the inventory.
- Add required links and test them on desktop and mobile.
- Write the request procedure and set up intake channels.
- Collect and review vendor terms.
- Review all documents at least annually and when practices change, and record each review date.
- Train staff and log it.
Quick check
Do I need a toll-free number?
The AG's FAQ says it applies to requests to know unless you operate exclusively online, in which case an email address is enough. Check the regulations for your case.
How often must the privacy policy be updated?
We did not confirm an interval in the pages we fetched. Review it at least yearly and whenever your practices change.
How Safeguard helps automate this
Documents drift from reality unless something checks the underlying systems. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, which saves your team time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, useful for showing which third-party libraries and SDKs ship in your product. Autonomous remediation can open tested fix pull requests; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not provide legal advice or make you compliant. Book a call.
Sources
- California Attorney General: CCPA
- California Privacy Protection Agency (CalPrivacy): laws and regulations
Last reviewed: 18 October 2026.
