What evidence do auditors commonly ask for on CCR 7012 Notice at collection: content, placement and third-party collection?

Inventory of collection points with the notice or link shown at each; Scripts for oral notice in call centres and in-store collection; Agreements with third parties that collect on the business's properties allocating notice duties; Evidence that tags and pixels do not load before the notice is available.

What is the most common gap auditors find on CCR 7012?

Notice placed only in the footer, far from where data is entered

CCPA/CPRA · Privacy policy, notices and choice design

`CCR 7012` Notice at collection: content, placement and third-party collection

The notice at collection must be easy to read, accessible and available where the consumer meets it at or before the point data is taken: near web form fields, on app download and settings pages, on paper forms, by signage or orally for in-person or phone collection. It lists categories collected (including sensitive ones), purposes, whether each is sold or shared, retention periods, a link to the opt-out notice where data is sold or shared, and a link to the privacy policy. If the notice is not given, the business may not collect. Where a third party controls collection on another business's site or premises, both must give notice, and a registered data broker that does not collect directly need not give one if it meets the conditions of the section.

Source: CCPA/CPRA, CCR 7012. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

artefacts

held by a system

at each review

hard

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Evidence that tags and pixels do not load before the notice is available · Data governance / DLP tooling

governing documentDocuments that govern the control

Inventory of collection points with the notice or link shown at each · Policy repository / GRC workspace
Scripts for oral notice in call centres and in-store collection · Policy repository / GRC workspace
Agreements with third parties that collect on the business's properties allocating notice duties · Vendor register / contract repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Notice placed only in the footer, far from where data is entered
Third-party trackers collecting before any notice is shown
Offline and phone channels without any notice

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CCR 7011 Privacy policy format, placement and required contents · CCR 7013 Notice of right to opt out of sale or sharing