A California website privacy policy is shaped by two separate statutes that people run together. One of them is old, applies to practically any commercial site with California visitors, and requires a policy at all. The other is recent, applies only above thresholds, and adds rights and disclosures on top. Knowing which one reaches you decides whether you owe a page or a program.
The law that makes a policy compulsory
The California Online Privacy Protection Act requires an operator of a commercial website or online service that collects personally identifiable information about California consumers to conspicuously post a privacy policy. It has no revenue or volume threshold, which is why it reaches a one-person shop. The policy has to identify the categories of information collected and the categories of third parties it is shared with, describe how a consumer can review and request changes, describe how changes to the policy are notified, and state its effective date.
Two things people miss in it
First, the statute addresses how the site responds to do-not-track signals and to other mechanisms offering consumers choice about tracking across sites, along with whether other parties may collect information about a visitor's activity across sites. A policy silent on tracking is incomplete under the older law before the newer one is considered. Second, conspicuously posted has a meaning: a link on the homepage using the word privacy, or an icon, reachable rather than buried.
What the consumer privacy law adds on top
Above the thresholds, a business owes considerably more in the policy itself: the categories of personal information collected, the sources, the business or commercial purposes, the categories disclosed, sold or shared and to whom, the retention period or the criteria for it, and a description of the rights to know, delete, correct, opt out of sale or sharing, limit sensitive information and be free of discrimination for exercising them. It also owes the mechanisms to exercise those rights and an update at least once every twelve months.
How to write one document for both
Use the newer law's structure, because it is a superset in nearly every respect, and make sure the older law's specific items are visible in it: the review and correction route, the change notification method, the effective date, and the tracking paragraph. Then put the effective date at the top rather than the bottom, and set a calendar reminder for the twelve-month update, because an unchanged date is the first thing anybody checks and the easiest defect to avoid.
Questions people ask about California website privacy policy
Do we need one if we are not in California?
Location does not decide it. Collecting personally identifiable information about California consumers through a commercial site is what brings the older statute into play, wherever the business sits.
Is there a minimum size?
Not for the policy requirement. The thresholds belong to the consumer privacy statute, which adds the rights and the fuller disclosures on top of a policy you already owe.
How often does it have to be updated?
A business in scope of the consumer privacy statute updates the policy at least once every twelve months. The older statute requires you to describe how you notify changes and to carry an effective date.
Does a template count as conspicuously posted?
The posting and the content are separate tests. A template can satisfy the content items if it is true of you, and it says nothing about whether the link is findable from the homepage.