CCPA Step 02: Update your Privacy Policy

There are several changes you should make to your privacy policy to comply with the CCPA.

1. Displaying Consumers' Rights

Display to the consumer all of their rights and how these can be used:

• Right to Opt-Out
• Right to limit the use of sensitive personal information
• Right to opt-out of automated decision making
• Right to know about automated decision making
• Right to Access
• Right to Delete
• Right to Correction
• Right to Data Portability

For the example of the “right to access” their data, you should provide a statement that explains their rights and how they can be enacted. Here's an example below.

Right of Access: You may request access to the specific pieces of Personal Information we have about you. You may also request additional details about our information practices, including the categories of Personal Information we collect, the sources of information, the types of third parties we share information with, the types of Personal Information we share for business purposes, and details about the information we have shared, if any. You may request access by visiting our Privacy Center (opens in a new tab) or contacting us via privacy@acme.com.

2. Notifying Users of Automated Tools

If your business is using any automated decision making tools for behavioral inference, analysis, or decision making, you should notify the user.

Provide the user with a written notice of automated decision making in your privacy policy, describing what categories of personal data you are using and for what type of automated decision making.

Note: in the case of automated decision making, you must also notify the user that when they exert their right to opt-out, you will not discriminate against them. That is to say, if they opt-out of automated processing, you will still provide the service to them within reasonable limitations.

3. Providing Privacy Notices

For each of the 11 categories of data you must have four clear notices as follows:

• Whether you collect that data: simply confirm whether this is a category of data you collect or not.
• How you use the data: confirm the purpose for which you use the data.
• Whether you share it: if you share the data, specify what other parties is it shared with.
• How long you retain the data: you must specify when the data is disposed of. It is no longer permissible to provide an approximation such as “for as long as is necessary”. The CPRA demands specificity.

The following table is a helpful way to consider how to display this information in your policy.

Note: in this description, we have provided an list of examples. You should complete this table with only the categories of data you process for each category.