If your website or app collects personal information from California residents, California law generally requires you to post a privacy policy, and many businesses must also meet the more detailed disclosure requirements of the California Consumer Privacy Act (CCPA). A good website privacy policy accurately describes what data you collect, how you use and share it, how long you keep it, and what rights users have. The most important “do” is accuracy: regulators treat a privacy policy as a set of public promises, and a policy that does not match your actual practices can create more risk than having a short, honest one.
Many startups copy a privacy policy from another website or generate one from a template at launch. That approach is risky because privacy laws have changed significantly, and a policy that describes someone else’s data practices is likely to be wrong for yours.
Is a Privacy Policy a Contract?
Not usually. Courts generally treat a privacy policy as a notice of the company’s practices rather than a binding agreement, while the website’s terms of use are the contract. But that does not reduce its importance. The Federal Trade Commission can pursue companies whose privacy statements are deceptive, and California regulators and private plaintiffs can bring claims when a policy’s promises are broken. Treat every statement in your policy as a representation you must be able to keep.
Which Laws Require a Privacy Policy?
CalOPPA
The California Online Privacy Protection Act (Business and Professions Code §22575 and following) requires operators of commercial websites and online services, including mobile apps, that collect personally identifiable information from California residents to conspicuously post a privacy policy. It must describe the categories of information collected, the categories of third parties it is shared with, how users can review and request changes (if offered), how the policy will be updated, its effective date, and how the site responds to “Do Not Track” signals.
The CCPA
The CCPA, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above a dollar amount that is adjusted periodically for inflation; buying, selling or sharing personal information of 100,000 or more California consumers or households; or deriving at least half of annual revenue from selling or sharing personal information. Covered businesses must provide a privacy policy that includes, among other things:
- Categories of personal information collected, their sources and the purposes for collection
- Categories disclosed to third parties, and whether information is sold or shared for cross-context behavioral advertising
- How long each category is retained
- Consumers’ rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information, and how to exercise them
- How the business responds to opt-out preference signals such as Global Privacy Control
The policy must be updated at least once every 12 months. The California Privacy Protection Agency has also adopted regulations on topics such as automated decisionmaking technology, risk assessments and cybersecurity audits, with requirements phasing in over several years. Our article on California’s new privacy laws covers recent developments.
Other Laws
- Children’s data. Sites directed to children under 13, or with actual knowledge of collecting their data, must comply with COPPA, including parental consent requirements. The FTC updated its COPPA rule in 2025.
- Other states. A growing number of states have comprehensive privacy laws with their own thresholds and disclosure requirements.
- International users. Businesses targeting users in the EU or UK may be subject to the GDPR or UK GDPR, which have their own transparency rules.
- Sector laws. Health, financial and education data may trigger additional obligations.
The Do’s
- Map your data first. Inventory what you collect (forms, accounts, payments, analytics, cookies, pixels, chat tools), where it is stored, who receives it and why.
- Describe your actual practices. Cover cookies and tracking technologies, analytics and advertising partners, service providers, and any data used to train AI models.
- Write clearly. California regulations expect plain language that the average consumer can understand.
- Link it conspicuously. Place the link in the footer of every page and at points of collection, such as sign-up forms and app stores.
- Provide working rights mechanisms. If the CCPA applies, offer request methods, honor opt-out preference signals, and include required links such as “Do Not Sell or Share My Personal Information” where applicable.
- Review it regularly. Update the policy whenever you add a new vendor, feature or data use, and at least annually.
- Coordinate with security. Describe security measures accurately and back them up with reasonable safeguards. See our article on cybersecurity laws.
The Don’ts
- Do not copy another company’s policy. It will describe someone else’s practices and may infringe their copyright.
- Do not overpromise. Statements like “we never share your data” or “your data is completely secure” are hard to keep and easy to challenge.
- Do not ignore tracking tools. Pixels, session replay and chat tools have prompted lawsuits under California’s wiretapping and privacy statutes when users were not properly informed.
- Do not make material changes silently. Using previously collected data in a materially different way may require notice and, in some cases, consent.
- Do not bury it. A policy that users cannot find does not meet CalOPPA’s conspicuous posting requirement.
Questions to Answer Before Drafting
- What personal information do we collect, and how?
- Do we use cookies, pixels or other tracking technologies, and for what purposes?
- Who are our service providers and advertising or analytics partners?
- Do we sell or share data, or use it for targeted advertising?
- Do we collect sensitive personal information or data from minors?
- How long do we keep each type of data, and how do users exercise their rights?
The Takeaway
A website privacy policy is a legal disclosure that regulators and plaintiffs read closely. An accurate, clearly written policy that reflects your real data practices and is reviewed regularly reduces risk and builds user trust. Pair it with well-drafted terms of use, as discussed in our article on legal aspects of e-commerce in California.
Frequently Asked Questions
Is a website privacy policy legally required in California?
Generally yes for commercial websites and apps that collect personally identifiable information from California residents. CalOPPA requires a conspicuously posted policy, and businesses covered by the CCPA must include additional disclosures.
Can I copy another company’s privacy policy?
You should not. A copied policy describes someone else’s data practices, so it is likely to be inaccurate for your business, and inaccurate privacy statements can lead to regulatory and private claims.
How often should a privacy policy be updated?
Businesses covered by the CCPA must update their privacy policy at least once every 12 months. Any business should also update it whenever it adds new data uses, vendors or tracking technologies.
Does my small startup need to comply with the CCPA?
Only if it meets one of the CCPA thresholds, such as the annual revenue threshold or handling personal information of 100,000 or more California consumers or households. CalOPPA can apply even if the CCPA does not.
How Sutter Law Can Help
Sutter Law drafts and reviews privacy policies, terms of use and data practices as part of our privacy compliance practice. Contact us for a free consultation.
This article is general information, not legal advice. Reading it does not create an attorney-client relationship.
