CCPA Notice at Collection and Opt-out Page Template
CCPA notice at collection: placement plan, categories with retention, workforce variant, Do Not Sell or Share page, signal status, third parties, checklist
How to use: Use it when the CCPA applies and you collect personal information online, by phone or in person. Fill the applicability check and the placement plan first, then build the category table from the same inventory as your privacy policy. The main pitfall is linking to the top of the privacy policy instead of the notice section, or selling data while no opt-out notice is posted.
Preview
Notice at Collection and Opt-out Page: [Business name]
Format for the two California consumer notices that sit beside a privacy policy: the Notice at Collection, shown at or before the point where personal information is collected, and the Notice of Right to Opt-out of Sale/Sharing behind the "Do Not Sell or Share My Personal Information" link (or the "Your Privacy Choices" alternative link). Based on the California Consumer Privacy Act (Civil Code 1798.100, 1798.120, 1798.121 and 1798.135, text effective 1 January 2026) and the CCPA Regulations (Cal. Code Regs. tit. 11, sections 7012 to 7015, 7025 and 7026, effective 1 January 2026). Replace every
[bracketed]value and every row marked Example. This is a documentation format, not legal advice. It makes no claim that the notices meet every requirement for your business. Check the current statute and regulations at cppa.ca.gov and have a qualified professional review the notices before you publish them.
Document control
| Field | Value |
|---|---|
| Document ID | [PRIV-NAC-001] |
| Business | [Legal name, address, website] |
| Version | [0.1] |
| Status | [Draft / Legal review / Approved / Published] |
| Owner | [@owner, Privacy] |
| Approvers / reviewers | [Privacy counsel], [Marketing lead], [Engineering lead] |
| Sells or shares personal information | [Yes / No] |
| Uses sensitive personal information beyond permitted purposes | [Yes / No] |
| Link model | [Two links / Alternative "Your Privacy Choices" link / Frictionless opt-out preference signal] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (at least every 12 months, and on any new data use) |
| Classification | Public once published |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Privacy counsel | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Marketing (cookies and ad tech owner) | [@name] | [Approved] | YYYY-MM-DD |
| Engineering (link and signal implementation) | [@name] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | Example: Published with footer link and opt-out preference signal status banner |
| 1.1 | YYYY-MM-DD | [@name] | Example: Added a new category (precise geolocation) for the delivery tracking feature |
1. Applicability check
| ID | Question | If yes | Answer |
|---|---|---|---|
| NAC-APP-001 | Are you a for-profit business that collects personal information of California residents and meets a CCPA threshold (revenue above the inflation-adjusted figure, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of annual revenue from selling or sharing it)? | The CCPA applies; continue | [Yes / No] |
| NAC-APP-002 | Do you collect personal information directly from consumers, or control its collection by others on your site? | Section 3 is required (reg. 7012(d): no notice, no collection) | [Yes / No] |
| NAC-APP-003 | Do you sell or share (for cross-context behavioural advertising) personal information, including through advertising cookies or pixels? | Section 5 is required, with a link or a frictionless signal | [Yes / No] |
| NAC-APP-004 | Do you use or disclose sensitive personal information for purposes other than those listed in reg. 7027(m)? | Add the Notice of Right to Limit and its link (reg. 7014), or use the alternative link | [Yes / No] |
| NAC-APP-005 | Do you collect personal information from job applicants, employees or contractors in California? | Section 4 is required | [Yes / No] |
| NAC-APP-006 | Do other businesses (ad networks, analytics, chat tools) control collection on your site? | Section 6 applies (reg. 7012(g)) | [Yes / No] |
| NAC-APP-007 | Do you have actual knowledge that you sell or share personal information of consumers under 16? | Opt-in consent is needed instead of opt-out; get advice | [Yes / No] |
If you do not sell or share personal information, you need neither the opt-out notice nor the link, provided your privacy policy says that you do not sell or share it (reg. 7013(g)).
2. Placement plan
| ID | Collection point | Channel | How the notice is given | Link target |
|---|---|---|---|---|
| NAC-PT-001 | [Website, all pages] | Online | Footer link "Notice at Collection" plus a link on the home page | [privacy-policy#notice-at-collection] |
| NAC-PT-002 | [Sign-up form] | Web form | Link next to the submit button | Same anchor |
| NAC-PT-003 | [Mobile app] | App | Link on the app store page and in Settings > Privacy | Same anchor |
| NAC-PT-004 | [Customer support calls] | Phone | Short oral notice by the agent, script in [support playbook] | Where to find it online |
| NAC-PT-005 | [Event registration desk] | Offline | Printed notice or a sign pointing to the online notice | Printed URL |
| NAC-PT-006 (Example) | Tarnwick Forms trial sign-up | Web form | "By signing up you agree to our Terms. See our Notice at Collection." with a link placed under the email field | /privacy#notice-at-collection |
Also place the opt-out link (section 5) in the header or footer of the home page (reg. 7013(c)), and give the opt-out notice in the same way you collect the information you sell or share, for example orally on a call (reg. 7013(e)(3)).
3. Notice at Collection (published text)
Notice at Collection for California residents. Last updated [YYYY-MM-DD].
[Business name] collects the personal information below when you [use our website and app, create an account, buy from us, or contact support]. This notice tells you what we collect, why, whether we sell or share it, and how long we keep it. Our full Privacy Policy explains your rights and how to use them.
| ID | Category | What this includes | Why we collect it | Sold or shared? | How long we keep it |
|---|---|---|---|---|---|
| NAC-CAT-001 | Identifiers | [Name, email, account ID, IP address] | [Create and secure your account; send service messages] | [No / Shared for advertising] | [Life of the account plus (N) months] |
| NAC-CAT-002 | Commercial information | [Plans bought, payment history] | [Billing, tax records] | [No] | [(N) years after the transaction, for tax law] |
| NAC-CAT-003 | Internet or network activity | [Pages viewed, clicks, device data] | [Analytics, product improvement, advertising] | [Shared] | [(N) months] |
| NAC-CAT-004 | Geolocation (approximate) | [City-level location from IP address] | [Fraud prevention, localisation] | [No] | [(N) days] |
| NAC-CAT-005 | Sensitive: account log-in | [Username with password] | [Account access and security] | [No] | [Life of the account] |
| NAC-CAT-006 (Example) | Form content you upload | Answers your respondents type into forms you build | Provide the form service | No | Until you delete the form, then 30 days in backups |
Sale and sharing. [We do not sell or share personal information.] or [We share internet activity and identifiers with advertising partners for cross-context behavioural advertising. You can opt out at Do Not Sell or Share My Personal Information.]
Sensitive personal information. [We use sensitive personal information only for purposes the regulations allow, such as providing the service you asked for and keeping your account secure.] or [You can limit our use of it at Limit the Use of My Sensitive Personal Information.]
More information. Read our Privacy Policy for the sources of information, the third parties we disclose it to, and how to exercise your rights to know, delete, correct and opt out.
4. Workforce notice variant
Notice at Collection for California job applicants, employees and contractors. Last updated [YYYY-MM-DD].
| ID | Category | Examples | Purpose | Sold or shared? | Retention |
|---|---|---|---|---|---|
| NAC-HR-001 | Identifiers and contact details | [Name, address, phone] | [Recruitment, employment administration] | No | [Period] |
| NAC-HR-002 | Professional or employment information | [CV, references, performance records] | [Hiring decisions, management] | No | [Period] |
| NAC-HR-003 | Sensitive: government identifiers | [Social Security number] | [Payroll, tax, right-to-work checks] | No | [Period required by law] |
| NAC-HR-004 | [Other category] | [Examples] | [Purpose] | [No] | [Period] |
Read the Workforce Privacy Policy for your rights and how to use them.
5. Notice of Right to Opt-out of Sale/Sharing (published page)
| Model | Link title | Basis | When it fits |
|---|---|---|---|
| Two links | "Do Not Sell or Share My Personal Information" and, if needed, "Limit the Use of My Sensitive Personal Information" | Civil Code 1798.135(a)(1) and (2); reg. 7013, 7014 | Default |
| Alternative link | "Your Privacy Choices" or "Your California Privacy Choices", with the opt-out icon next to it | Civil Code 1798.135(a)(3); reg. 7015 | One page for both rights |
| Frictionless signal | No link, if opt-out preference signals are processed in a frictionless manner under reg. 7025(f) and (g) | Civil Code 1798.135(b); reg. 7013(d) | Check every condition first; the notice still goes in the privacy policy |
Your right to opt out of the sale or sharing of your personal information. Last updated [YYYY-MM-DD].
California law gives you the right to tell us to stop selling your personal information and stop sharing it for cross-context behavioural advertising. We [share identifiers and internet activity with advertising partners to show you ads on other sites].
How to opt out.
- Use the form below. [Opt-out form: toggle "Do not sell or share my personal information" and Save. No account is needed.]
- Turn on an opt-out preference signal such as Global Privacy Control in your browser. We treat it as an opt-out for that browser or device and, if we know who you are, for your account.
- [Email privacy@example.com or call (toll-free number).]
Signal status. [When we detect a valid signal, this page shows "Opt-Out Request Honored" and the toggle above is set to opted out.]
What happens next. We stop selling and sharing your personal information as soon as feasibly possible and no later than 15 business days after we receive your request. If we sold or shared your information between your request and that point, we tell those third parties about your opt-out and ask them to pass it on. We will not ask you to opt back in for at least 12 months, and you can change your choice at any time.
Authorised agents. Someone you authorise can opt out for you. [Describe how they show authorisation.]
Limit the use of sensitive personal information. [Include this part only on the alternative-link page or if you use sensitive personal information beyond permitted purposes: description of the right and the form.]
6. Third parties that control collection
| ID | Third party | What it collects on our site | Purpose | Its notice | Covered in our combined notice? |
|---|---|---|---|---|---|
| NAC-TP-001 | [Ad network] | [Cookie IDs, page views] | [Ad targeting] | [Link] | [Yes / No] |
| NAC-TP-002 | [Analytics provider] | [Usage events] | [Analytics] | [Link] | [Yes / No] |
| NAC-TP-003 (Example) | Fictional ad network "Pinecastle Ads" | Cookie ID, pages viewed | Retargeting | Linked from the cookie banner | Yes |
7. Implementation checklist
- Every collection point in section 2 shows the notice at or before collection (reg. 7012(c), (d)).
- Online links go straight to the notice section, not the top of the privacy policy (reg. 7012(f)).
- The notice lists categories, sensitive categories, purposes, sold or shared status and retention for each category (reg. 7012(e); Civil Code 1798.100(a)).
- Categories, purposes and retention match the privacy policy and the records of processing (compliance/gdpr-ropa if you also map GDPR processing).
- The opt-out link sits in the header or footer of the home page, or the alternative link has the icon (reg. 7013(c), 7015(b)).
- The opt-out page has the interactive form and at least two methods are offered (reg. 7013(f), 7026(a)).
- The site processes opt-out preference signals and shows whether a signal was processed (reg. 7025(c)(6)).
- Opt-outs are applied as soon as feasibly possible and within 15 business days, and third parties that received data in between are notified (reg. 7026(f)).
- Notices are easy to read, available in the languages you use with consumers, and accessible (reg. 7003).
- Workforce notice issued to applicants and staff (section 4).
- Rights requests feed into the procedure in compliance/data-subject-request-procedure.
- Review date set; ADMT notices handled separately if you use automated decisionmaking technology for significant decisions (see legal-lite/privacy-policy).
References
| Source | Status / date checked | Used for |
|---|---|---|
| California Consumer Privacy Act of 2018, Civil Code 1798.100 to 1798.199.100, CPPA posting effective 1 January 2026 (cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) | Read 2026-10-30 | 1798.100(a) notice content; 1798.135 link titles and signal option |
| CCPA Regulations, Cal. Code Regs. tit. 11, division 6, chapter 1, effective 1 January 2026 (cppa.ca.gov/regulations) | Read 2026-10-30 | Sections 7012, 7013, 7014, 7015, 7025(c)(6), 7026 |
| California Privacy Protection Agency, Regulations page (cppa.ca.gov/regulations/) | Read 2026-10-30; preliminary rulemaking on opt-out preference signals and on notices and disclosures had closed comment periods, no formal proposal | Watch for changes |
| Privacy Policy (legal-lite/privacy-policy), Cookie Policy (legal-lite/cookie-policy) | This collection | Linked documents |
Standard and licence note
Based on the California Consumer Privacy Act (Civil Code 1798.100 and following, as posted by the California Privacy Protection Agency with effect from 1 January 2026) and the CCPA Regulations (Cal. Code Regs. tit. 11, sections 7000 and following, effective 1 January 2026), summarised in original words. Link titles are quoted because the law prescribes them. Check the current statute and regulations before use. This is a documentation format, not legal advice: it does not create a lawyer-client relationship and makes no claim that the notices satisfy the law for any business. Original text written for this collection; example rows are fictional. Template licence: MIT.
Related templates
Accessibility Statement Template (EU Model, EAA, UK)
Accessibility statement: regime table (WAD, EAA, UK, ADA), compliance status, non-accessible content, preparation, feedback, enforcement, improvement plan
LegalCookie Policy Template (EU ePrivacy, UK PECR, CCPA)
Cookie policy: applicability check, watch list, consent banner checklist, categories, cookie list, choices and GPC, third parties, consent records
LegalData Processing Agreement (DPA) Template (GDPR Art. 28)
Controller-processor DPA: Art. 28(3)(a)-(h) terms, sub-processors, breach notice, audits, transfer tools (SCCs, DPF, UK IDTA), CCPA s. 7051 terms, annexes