---
title: "Draft or review a privacy notice and a notice at collection"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-or-review-a-privacy-policy-and-collection-notice/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R2-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Draft or review a privacy notice and a notice at collection

> Turn the client's data map into a section outline for a privacy notice and a notice at collection, with a blank beside each statutory item.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-or-review-a-privacy-policy-and-collection-notice/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Turn the client's data map into a section outline for a privacy notice and a notice at collection, with a blank beside each statutory item. |
| What the lawyer must review | Civil Code section 1798.100 requires a business that controls collection to say, at or before collection, the categories collected, the purposes, whether the information is sold or shared, the sensitive-information categories where relevant, and the retention period or the criteria used to set it. Collection must be reasonably necessary and proportionate to the disclosed purpose. The Attorney General's CCPA page states the consumer rights the notice has to be able to support, including know, delete, correct, opt out of sale or sharing, and limit use of sensitive information. There is no single federal privacy statute. If the data are protected health information or non-public financial information, open HIPAA or the Gramm-Leach-Bliley Act before you treat a CCPA notice as enough. Opinion 512: verify the draft and do not put client data into a tool whose retention and training use you have not checked. Model Rule 1.6 still applies. |
| Written for | United States |
| Applies to | [Draft or review a privacy policy and collection notice](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-or-review-a-privacy-policy-and-collection-notice.md) |

## Checking plan

- What the AI does: Turn the client's data map into a section outline for a privacy notice and a notice at collection, with a blank beside each statutory item.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Name the statute that covers the data. Do not describe US privacy law as one instrument.
- The notice is published. Read every sentence against the current Civil Code and the regulations before it goes up.

## Sources

- [California Civil Code section 1798.100 (general duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [CCPA privacy policy](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-ccpa-privacy-policy.md) | Policy | Yellow | Privacy policy for a business that the California Consumer Privacy Act may cover. It sets out categories, retention, sale or sharing, and the rights in the sections that were read.… |
| [Notice at collection](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-notice-at-collection.md) | Notice | Yellow | Short notice given at or before the point of collection under Civil Code § 1798.100(a). It states categories, purposes, whether the information is sold or shared, and retention.… |
| [Collection notice (APP 5) for forms, websites, apps and call scripts](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/app-5-collection-notice.md) | Notice | Yellow | Collection notice covering each APP 5.2 matter (identity, third-party collection, legal authority, purposes, consequences, usual disclosures, access and complaints, overseas disclosure), with a… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*