California Consumer Privacy Act (as amended by CPRA)
CCPA Privacy Policy Requirements, in Plain English
California's privacy law, decoded for developers — who it covers, what your policy must say, and what to skip.
Not legal advice. This guide is a plain-English summary for developers, not a substitute for advice from a qualified lawyer. For high-risk or regulated processing, get a professional review.
What CCPA requires of your privacy policy
The CCPA (California Consumer Privacy Act), significantly expanded by the CPRA in 2023, is the United States' most consequential privacy law. Unlike GDPR, it doesn't apply to everyone: it covers for-profit businesses that do business in California and meet at least one threshold — roughly $25 million+ in annual revenue (inflation-adjusted), buying/selling/sharing personal information of 100,000+ California consumers or households per year, or earning 50%+ of revenue from selling or sharing personal information.
Most indie apps are below those thresholds. So why care? Three reasons. First, growth: 100,000 California users arrives faster than you think, and retrofitting compliance is painful. Second, ecosystem pressure: app stores, ad networks, and enterprise customers increasingly expect CCPA-style disclosures regardless of your size. Third, California is rarely alone — a dozen-plus US states now have similar laws with lower or different thresholds, and a CCPA-grade policy substantially covers them.
If CCPA applies, your privacy policy must disclose, for the past 12 months: the categories of personal information you collected (using the law's categories — identifiers, commercial information, internet activity, geolocation, inferences, and so on); the sources of that information; the business purposes for collecting it; and the categories of third parties you disclosed, sold, or shared it with. "Sharing" notably includes giving data to ad networks for cross-context behavioral advertising — many apps "share" under CCPA without ever selling anything.
The policy must also explain California consumers' rights: to know what you've collected, to delete it, to correct it, to opt out of sale or sharing, to limit use of sensitive personal information, and to be free from discrimination for exercising any of these. If you sell or share data, you need a "Do Not Sell or Share My Personal Information" link, and you must honor Global Privacy Control (GPC) browser signals. The policy must state how to submit requests (at least two methods) and be updated at least every 12 months.
CCPA privacy policy checklist
- Categories of personal information collected in the past 12 months (using CCPA categories)
- Sources of each category (directly from users, automatically, from third parties)
- Business or commercial purposes for collection, use, and sharing
- Categories of third parties data is disclosed to, sold to, or shared with
- Whether you sell or share personal information — stated explicitly, even if the answer is no
- Consumer rights: know, delete, correct, opt out of sale/sharing, limit sensitive PI, non-discrimination
- At least two methods to submit requests (e.g. email and a web form)
- "Do Not Sell or Share My Personal Information" link — if you sell or share
- Recognition of Global Privacy Control (GPC) signals — if you sell or share
- Retention periods or criteria for each category of personal information
- A "last updated" date, refreshed at least every 12 months
How PrivacyPage covers CCPA
CCPA category mapping
The wizard translates your plain-English answers into the CCPA's formal categories — identifiers, internet activity, geolocation, inferences — so the disclosures use the language the law expects.
Sale/sharing handled honestly
Most indie apps don't sell data. Your generated policy states that explicitly — which the CCPA requires — and includes opt-out language only when your answers indicate you actually share for advertising.
All consumer rights included
Know, delete, correct, opt out, limit sensitive PI, and non-discrimination — with request instructions and response timelines spelled out.
Paired with GDPR coverage
Generated policies include both CCPA and GDPR sections, which together substantially cover most other US state privacy laws too.
Generate a CCPA-ready privacy policy
Answer ~10 questions about your app. Preview the full document free — pay $9.99 once only to unlock it.
Generate Now →FAQ
My app is small — do I need CCPA disclosures at all?
Legally, only if you meet a threshold (~$25M revenue, 100k+ CA consumers, or 50%+ revenue from data sales). Practically, including CCPA-style disclosures costs nothing, future-proofs your growth, and satisfies partners and stores that expect them. PrivacyPage includes them by default.
What counts as "selling" data under CCPA?
Broader than cash sales: any transfer of personal information to a third party for valuable consideration. "Sharing" is broader still — passing data to ad networks for cross-context behavioral advertising counts, which is why apps with third-party ad SDKs often need the opt-out link.
Do I need a "Do Not Sell or Share" link?
Only if you sell or share personal information as the CCPA defines it. If you run no third-party advertising and don't sell data, you state that in your policy instead — explicitly.
How is CCPA different from GDPR?
GDPR applies to nearly everyone touching EU data and requires legal bases before processing; CCPA applies only above thresholds and focuses on disclosure and opt-out rights after collection. A well-built policy covers both — see our GDPR vs CCPA developer guide for the full breakdown.