CCR 7011 Privacy policy format, placement and required contents

The privacy policy must give a full account of online and offline practices, be printable, follow the plain-language and accessibility rules of section 7003, and be reachable from a conspicuous link containing the word privacy on the homepage and in a mobile app's settings and download page. Beyond the statutory lists it must state whether the business knowingly sells or shares data of consumers under 16, whether it uses sensitive data beyond the permitted purposes, each consumer right (including the ADMT opt-out and access rights where Article 11 applies), how to exercise them, how identity is verified, how opt-out preference signals are honoured, how authorised agents may act, a contact point, the date of last update and, for businesses covered by section 7102, the annual metrics or a link to them.

Source: CCPA/CPRA, CCR 7011. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).