# Notice at Collection and Opt-out Page: [Business name]

> Format for the two California consumer notices that sit beside a
> privacy policy: the **Notice at Collection**, shown at or before the
> point where personal information is collected, and the **Notice of
> Right to Opt-out of Sale/Sharing** behind the "Do Not Sell or Share My
> Personal Information" link (or the "Your Privacy Choices" alternative
> link). Based on the California Consumer Privacy Act (Civil Code
> 1798.100, 1798.120, 1798.121 and 1798.135, text effective 1 January 2026)
> and the CCPA Regulations (Cal. Code Regs. tit. 11, sections 7012 to
> 7015, 7025 and 7026, effective 1 January 2026). Replace every
> `[bracketed]` value and every row marked *Example*.
> **This is a documentation format, not legal advice.** It makes no claim that the notices
> meet every requirement for your business. Check the current statute and
> regulations at cppa.ca.gov and have a qualified professional review
> the notices before you publish them.

<!--
Guidance: How to use this template
- Fill section 1 first. If the CCPA does not apply to you, or you do
  not sell or share personal information, parts of this template are
  not needed; the table says which.
- The Notice at Collection is a short summary. Its content must match
  the full privacy policy (legal-lite/privacy-policy). Keep one
  inventory of categories, purposes and retention and generate both
  documents from it.
- Section 2 is the placement plan: the law cares where the notice
  appears as much as what it says.
- Publish sections 3 and 5 (and 4 if you collect workforce data). Keep
  sections 1, 2, 6 and 7 internal.
- Other US states have their own privacy notice rules. This template
  covers California only; add each state you are subject to.
-->

## Document control

<!-- Guidance: Internal record. The published notices show only a "Last updated" date. The CCPA requires the privacy policy to be updated at least once every 12 months; review these notices at the same time. -->

| Field | Value |
|---|---|
| Document ID | [PRIV-NAC-001] |
| Business | [Legal name, address, website] |
| Version | [0.1] |
| Status | [Draft / Legal review / Approved / Published] |
| Owner | [@owner, Privacy] |
| Approvers / reviewers | [Privacy counsel], [Marketing lead], [Engineering lead] |
| Sells or shares personal information | [Yes / No] |
| Uses sensitive personal information beyond permitted purposes | [Yes / No] |
| Link model | [Two links / Alternative "Your Privacy Choices" link / Frictionless opt-out preference signal] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (at least every 12 months, and on any new data use) |
| Classification | Public once published |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Privacy counsel | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Marketing (cookies and ad tech owner) | [@name] | [Approved] | YYYY-MM-DD |
| Engineering (link and signal implementation) | [@name] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Published with footer link and opt-out preference signal status banner |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Added a new category (precise geolocation) for the delivery tracking feature |

## 1. Applicability check

<!-- Guidance: Answer each question for the business as a whole. The CCPA thresholds, including the inflation-adjusted revenue figure in Civil Code 1798.140(d), change; check the current figure on cppa.ca.gov rather than relying on a number copied from elsewhere. -->

| ID | Question | If yes | Answer |
|---|---|---|---|
| NAC-APP-001 | Are you a for-profit business that collects personal information of California residents and meets a CCPA threshold (revenue above the inflation-adjusted figure, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of annual revenue from selling or sharing it)? | The CCPA applies; continue | [Yes / No] |
| NAC-APP-002 | Do you collect personal information directly from consumers, or control its collection by others on your site? | Section 3 is required (reg. 7012(d): no notice, no collection) | [Yes / No] |
| NAC-APP-003 | Do you sell or share (for cross-context behavioural advertising) personal information, including through advertising cookies or pixels? | Section 5 is required, with a link or a frictionless signal | [Yes / No] |
| NAC-APP-004 | Do you use or disclose sensitive personal information for purposes other than those listed in reg. 7027(m)? | Add the Notice of Right to Limit and its link (reg. 7014), or use the alternative link | [Yes / No] |
| NAC-APP-005 | Do you collect personal information from job applicants, employees or contractors in California? | Section 4 is required | [Yes / No] |
| NAC-APP-006 | Do other businesses (ad networks, analytics, chat tools) control collection on your site? | Section 6 applies (reg. 7012(g)) | [Yes / No] |
| NAC-APP-007 | Do you have actual knowledge that you sell or share personal information of consumers under 16? | Opt-in consent is needed instead of opt-out; get advice | [Yes / No] |

If you do not sell or share personal information, you need neither the
opt-out notice nor the link, provided your privacy policy says that you
do not sell or share it (reg. 7013(g)).

## 2. Placement plan

<!-- Guidance: Regulation 7012(c) requires the notice to be readily available where consumers meet it, at or before collection, and gives examples per channel. Map every point of collection. Common pitfall: a link that opens the top of the privacy policy, which reg. 7012(f) says is not enough; link straight to the section with the required content. -->

| ID | Collection point | Channel | How the notice is given | Link target |
|---|---|---|---|---|
| NAC-PT-001 | [Website, all pages] | Online | Footer link "Notice at Collection" plus a link on the home page | [privacy-policy#notice-at-collection] |
| NAC-PT-002 | [Sign-up form] | Web form | Link next to the submit button | Same anchor |
| NAC-PT-003 | [Mobile app] | App | Link on the app store page and in Settings > Privacy | Same anchor |
| NAC-PT-004 | [Customer support calls] | Phone | Short oral notice by the agent, script in [support playbook] | Where to find it online |
| NAC-PT-005 | [Event registration desk] | Offline | Printed notice or a sign pointing to the online notice | Printed URL |
| NAC-PT-006 *(Example)* | Tarnwick Forms trial sign-up | Web form | "By signing up you agree to our Terms. See our Notice at Collection." with a link placed under the email field | /privacy#notice-at-collection |

Also place the opt-out link (section 5) in the header or footer of the
home page (reg. 7013(c)), and give the opt-out notice in the same way you
collect the information you sell or share, for example orally on a
call (reg. 7013(e)(3)).

## 3. Notice at Collection (published text)

<!-- Guidance: Regulation 7012(e) lists six items: categories (including sensitive categories), purposes, whether each category is sold or shared, retention per category, the opt-out link if you sell or share, and a link to the privacy policy. Write each category so a consumer understands it; the statutory category names alone are often not enough. Do not collect a new category, or use data for an incompatible new purpose, without updating the notice (Civil Code 1798.100(a)). -->

**Notice at Collection for California residents.** Last updated
[YYYY-MM-DD].

[Business name] collects the personal information below when you
[use our website and app, create an account, buy from us, or contact
support]. This notice tells you what we collect, why, whether we sell
or share it, and how long we keep it. Our full
[Privacy Policy](link) explains your rights and how to use them.

| ID | Category | What this includes | Why we collect it | Sold or shared? | How long we keep it |
|---|---|---|---|---|---|
| NAC-CAT-001 | Identifiers | [Name, email, account ID, IP address] | [Create and secure your account; send service messages] | [No / Shared for advertising] | [Life of the account plus (N) months] |
| NAC-CAT-002 | Commercial information | [Plans bought, payment history] | [Billing, tax records] | [No] | [(N) years after the transaction, for tax law] |
| NAC-CAT-003 | Internet or network activity | [Pages viewed, clicks, device data] | [Analytics, product improvement, advertising] | [Shared] | [(N) months] |
| NAC-CAT-004 | Geolocation (approximate) | [City-level location from IP address] | [Fraud prevention, localisation] | [No] | [(N) days] |
| NAC-CAT-005 | Sensitive: account log-in | [Username with password] | [Account access and security] | [No] | [Life of the account] |
| NAC-CAT-006 *(Example)* | Form content you upload | Answers your respondents type into forms you build | Provide the form service | No | Until you delete the form, then 30 days in backups |

**Sale and sharing.** [We do not sell or share personal information.]
*or* [We share internet activity and identifiers with advertising
partners for cross-context behavioural advertising. You can opt out at
[Do Not Sell or Share My Personal Information](link).]

**Sensitive personal information.** [We use sensitive personal
information only for purposes the regulations allow, such as providing
the service you asked for and keeping your account secure.] *or* [You
can limit our use of it at [Limit the Use of My Sensitive Personal
Information](link).]

**More information.** Read our [Privacy Policy](link) for the sources
of information, the third parties we disclose it to, and how to
exercise your rights to know, delete, correct and opt out.

## 4. Workforce notice variant

<!-- Guidance: Since 1 January 2023 the CCPA covers job applicants, employees and contractors. Give them their own notice at the point of collection (application form, onboarding pack). Keep it separate from the consumer notice so it is relevant to them. -->

**Notice at Collection for California job applicants, employees and
contractors.** Last updated [YYYY-MM-DD].

| ID | Category | Examples | Purpose | Sold or shared? | Retention |
|---|---|---|---|---|---|
| NAC-HR-001 | Identifiers and contact details | [Name, address, phone] | [Recruitment, employment administration] | No | [Period] |
| NAC-HR-002 | Professional or employment information | [CV, references, performance records] | [Hiring decisions, management] | No | [Period] |
| NAC-HR-003 | Sensitive: government identifiers | [Social Security number] | [Payroll, tax, right-to-work checks] | No | [Period required by law] |
| NAC-HR-004 | [Other category] | [Examples] | [Purpose] | [No] | [Period] |

Read the [Workforce Privacy Policy](link) for your rights and how to
use them.

## 5. Notice of Right to Opt-out of Sale/Sharing (published page)

<!-- Guidance: Regulation 7013(f) requires a description of the right and instructions, including the interactive opt-out form online. Regulation 7026(a) requires at least two methods to submit an opt-out, and 7026(f) says to stop selling or sharing within 15 business days. Regulation 7025(c)(6) requires you to show on your website whether you have processed an opt-out preference signal. Choose your link model in the table below. -->

| Model | Link title | Basis | When it fits |
|---|---|---|---|
| Two links | "Do Not Sell or Share My Personal Information" and, if needed, "Limit the Use of My Sensitive Personal Information" | Civil Code 1798.135(a)(1) and (2); reg. 7013, 7014 | Default |
| Alternative link | "Your Privacy Choices" or "Your California Privacy Choices", with the opt-out icon next to it | Civil Code 1798.135(a)(3); reg. 7015 | One page for both rights |
| Frictionless signal | No link, if opt-out preference signals are processed in a frictionless manner under reg. 7025(f) and (g) | Civil Code 1798.135(b); reg. 7013(d) | Check every condition first; the notice still goes in the privacy policy |

**Your right to opt out of the sale or sharing of your personal
information.** Last updated [YYYY-MM-DD].

California law gives you the right to tell us to stop selling your
personal information and stop sharing it for cross-context behavioural
advertising. We [share identifiers and internet activity with
advertising partners to show you ads on other sites].

**How to opt out.**

1. Use the form below. [Opt-out form: toggle "Do not sell or share my
   personal information" and Save. No account is needed.]
2. Turn on an opt-out preference signal such as Global Privacy Control
   in your browser. We treat it as an opt-out for that browser or
   device and, if we know who you are, for your account.
3. [Email privacy@example.com or call (toll-free number).]

**Signal status.** [When we detect a valid signal, this page shows
"Opt-Out Request Honored" and the toggle above is set to opted out.]

**What happens next.** We stop selling and sharing your personal
information as soon as feasibly possible and no later than 15 business
days after we receive your request. If we sold or shared your
information between your request and that point, we tell those third
parties about your opt-out and ask them to pass it on. We will not ask you to opt back
in for at least 12 months, and you can change your choice at any time.

**Authorised agents.** Someone you authorise can opt out for you.
[Describe how they show authorisation.]

**Limit the use of sensitive personal information.** [Include this
part only on the alternative-link page or if you use sensitive personal
information beyond permitted purposes: description of the right and the
form.]

## 6. Third parties that control collection

<!-- Guidance: Regulation 7012(g): when an ad network or other third party controls collection on your site, both you and the third party must give a Notice at Collection; you may give one combined notice. Keep this list in step with your cookie inventory (legal-lite/cookie-policy). -->

| ID | Third party | What it collects on our site | Purpose | Its notice | Covered in our combined notice? |
|---|---|---|---|---|---|
| NAC-TP-001 | [Ad network] | [Cookie IDs, page views] | [Ad targeting] | [Link] | [Yes / No] |
| NAC-TP-002 | [Analytics provider] | [Usage events] | [Analytics] | [Link] | [Yes / No] |
| NAC-TP-003 *(Example)* | Fictional ad network "Pinecastle Ads" | Cookie ID, pages viewed | Retargeting | Linked from the cookie banner | Yes |

## 7. Implementation checklist

<!-- Guidance: Run this before publishing and at each review. Each line names the rule it checks so a reviewer can verify it against the current text. -->

- [ ] Every collection point in section 2 shows the notice at or before collection (reg. 7012(c), (d)).
- [ ] Online links go straight to the notice section, not the top of the privacy policy (reg. 7012(f)).
- [ ] The notice lists categories, sensitive categories, purposes, sold or shared status and retention for each category (reg. 7012(e); Civil Code 1798.100(a)).
- [ ] Categories, purposes and retention match the privacy policy and the records of processing (compliance/gdpr-ropa if you also map GDPR processing).
- [ ] The opt-out link sits in the header or footer of the home page, or the alternative link has the icon (reg. 7013(c), 7015(b)).
- [ ] The opt-out page has the interactive form and at least two methods are offered (reg. 7013(f), 7026(a)).
- [ ] The site processes opt-out preference signals and shows whether a signal was processed (reg. 7025(c)(6)).
- [ ] Opt-outs are applied as soon as feasibly possible and within 15 business days, and third parties that received data in between are notified (reg. 7026(f)).
- [ ] Notices are easy to read, available in the languages you use with consumers, and accessible (reg. 7003).
- [ ] Workforce notice issued to applicants and staff (section 4).
- [ ] Rights requests feed into the procedure in compliance/data-subject-request-procedure.
- [ ] Review date set; ADMT notices handled separately if you use automated decisionmaking technology for significant decisions (see legal-lite/privacy-policy).

## References

<!-- Guidance: Sources checked on the date shown. Laws and regulations change; open the current text before each review. -->

| Source | Status / date checked | Used for |
|---|---|---|
| California Consumer Privacy Act of 2018, Civil Code 1798.100 to 1798.199.100, CPPA posting effective 1 January 2026 (cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) | Read 2026-10-30 | 1798.100(a) notice content; 1798.135 link titles and signal option |
| CCPA Regulations, Cal. Code Regs. tit. 11, division 6, chapter 1, effective 1 January 2026 (cppa.ca.gov/regulations) | Read 2026-10-30 | Sections 7012, 7013, 7014, 7015, 7025(c)(6), 7026 |
| California Privacy Protection Agency, Regulations page (cppa.ca.gov/regulations/) | Read 2026-10-30; preliminary rulemaking on opt-out preference signals and on notices and disclosures had closed comment periods, no formal proposal | Watch for changes |
| Privacy Policy (legal-lite/privacy-policy), Cookie Policy (legal-lite/cookie-policy) | This collection | Linked documents |

## Standard and licence note

Based on the California Consumer Privacy Act (Civil Code 1798.100 and
following, as posted by the California Privacy Protection Agency with
effect from 1 January 2026) and the CCPA Regulations (Cal. Code Regs.
tit. 11, sections 7000 and following, effective 1 January 2026),
summarised in original words. Link titles are quoted because the law
prescribes them. Check the current statute and regulations before use.
This is a documentation format, not legal advice: it does not create a
lawyer-client relationship and makes no claim that the notices satisfy
the law for any business. Original text written for this collection;
example rows are fictional.
Template licence: MIT.