CCPA Notice at Collection and Opt-out Page Template

Notice at Collection and Opt-out Page: [Business name]

Format for the two California consumer notices that sit beside a privacy policy: the Notice at Collection, shown at or before the point where personal information is collected, and the Notice of Right to Opt-out of Sale/Sharing behind the "Do Not Sell or Share My Personal Information" link (or the "Your Privacy Choices" alternative link). Based on the California Consumer Privacy Act (Civil Code 1798.100, 1798.120, 1798.121 and 1798.135, text effective 1 January 2026) and the CCPA Regulations (Cal. Code Regs. tit. 11, sections 7012 to 7015, 7025 and 7026, effective 1 January 2026). Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice. It makes no claim that the notices meet every requirement for your business. Check the current statute and regulations at cppa.ca.gov and have a qualified professional review the notices before you publish them.

Document control

Approvals

Revision history

1. Applicability check

If you do not sell or share personal information, you need neither the opt-out notice nor the link, provided your privacy policy says that you do not sell or share it (reg. 7013(g)).

2. Placement plan

Also place the opt-out link (section 5) in the header or footer of the home page (reg. 7013(c)), and give the opt-out notice in the same way you collect the information you sell or share, for example orally on a call (reg. 7013(e)(3)).

3. Notice at Collection (published text)

Notice at Collection for California residents. Last updated [YYYY-MM-DD].

[Business name] collects the personal information below when you [use our website and app, create an account, buy from us, or contact support]. This notice tells you what we collect, why, whether we sell or share it, and how long we keep it. Our full Privacy Policy explains your rights and how to use them.

Sale and sharing. [We do not sell or share personal information.] or [We share internet activity and identifiers with advertising partners for cross-context behavioural advertising. You can opt out at Do Not Sell or Share My Personal Information.]

Sensitive personal information. [We use sensitive personal information only for purposes the regulations allow, such as providing the service you asked for and keeping your account secure.] or [You can limit our use of it at Limit the Use of My Sensitive Personal Information.]

More information. Read our Privacy Policy for the sources of information, the third parties we disclose it to, and how to exercise your rights to know, delete, correct and opt out.

4. Workforce notice variant

Notice at Collection for California job applicants, employees and contractors. Last updated [YYYY-MM-DD].

Read the Workforce Privacy Policy for your rights and how to use them.

5. Notice of Right to Opt-out of Sale/Sharing (published page)

Your right to opt out of the sale or sharing of your personal information. Last updated [YYYY-MM-DD].

California law gives you the right to tell us to stop selling your personal information and stop sharing it for cross-context behavioural advertising. We [share identifiers and internet activity with advertising partners to show you ads on other sites].

How to opt out.

1. Use the form below. [Opt-out form: toggle "Do not sell or share my personal information" and Save. No account is needed.]
2. Turn on an opt-out preference signal such as Global Privacy Control in your browser. We treat it as an opt-out for that browser or device and, if we know who you are, for your account.
3. [Email privacy@example.com or call (toll-free number).]

Signal status. [When we detect a valid signal, this page shows "Opt-Out Request Honored" and the toggle above is set to opted out.]

What happens next. We stop selling and sharing your personal information as soon as feasibly possible and no later than 15 business days after we receive your request. If we sold or shared your information between your request and that point, we tell those third parties about your opt-out and ask them to pass it on. We will not ask you to opt back in for at least 12 months, and you can change your choice at any time.

Authorised agents. Someone you authorise can opt out for you. [Describe how they show authorisation.]

Limit the use of sensitive personal information. [Include this part only on the alternative-link page or if you use sensitive personal information beyond permitted purposes: description of the right and the form.]

6. Third parties that control collection

7. Implementation checklist

• Every collection point in section 2 shows the notice at or before collection (reg. 7012(c), (d)).
• Online links go straight to the notice section, not the top of the privacy policy (reg. 7012(f)).
• The notice lists categories, sensitive categories, purposes, sold or shared status and retention for each category (reg. 7012(e); Civil Code 1798.100(a)).
• Categories, purposes and retention match the privacy policy and the records of processing (compliance/gdpr-ropa if you also map GDPR processing).
• The opt-out link sits in the header or footer of the home page, or the alternative link has the icon (reg. 7013(c), 7015(b)).
• The opt-out page has the interactive form and at least two methods are offered (reg. 7013(f), 7026(a)).
• The site processes opt-out preference signals and shows whether a signal was processed (reg. 7025(c)(6)).
• Opt-outs are applied as soon as feasibly possible and within 15 business days, and third parties that received data in between are notified (reg. 7026(f)).
• Notices are easy to read, available in the languages you use with consumers, and accessible (reg. 7003).
• Workforce notice issued to applicants and staff (section 4).
• Rights requests feed into the procedure in compliance/data-subject-request-procedure.
• Review date set; ADMT notices handled separately if you use automated decisionmaking technology for significant decisions (see legal-lite/privacy-policy).

References

Standard and licence note

Based on the California Consumer Privacy Act (Civil Code 1798.100 and following, as posted by the California Privacy Protection Agency with effect from 1 January 2026) and the CCPA Regulations (Cal. Code Regs. tit. 11, sections 7000 and following, effective 1 January 2026), summarised in original words. Link titles are quoted because the law prescribes them. Check the current statute and regulations before use. This is a documentation format, not legal advice: it does not create a lawyer-client relationship and makes no claim that the notices satisfy the law for any business. Original text written for this collection; example rows are fictional. Template licence: MIT.