---
title: "CCPA privacy policy"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-ccpa-privacy-policy"
type: "precedent"
site: "AI Law Framework"
id: "a25-us-ccpa-privacy-policy"
area_id: "A25"
kind: "policy"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R2", "A25-B1-2"]
law_stated_as_at: "2026-10-22"
---

# CCPA privacy policy

> Privacy policy for a business that the California Consumer Privacy Act may cover. It sets out categories, retention, sale or sharing, and the rights in the sections that were read.…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-ccpa-privacy-policy  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

Privacy policy for a business that the California Consumer Privacy Act may cover. It sets out categories, retention, sale or sharing, and the rights in the sections that were read. Sections that were not opened are left for the lawyer to write.

## Key facts

- Kind: Policy. A policy or procedure for a firm or client.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 5 authorities it cites, for United States.

## When to use it

Use when a for-profit business doing business in California needs the policy section 1798.130 describes. Do not publish it until the lawyer has confirmed the business test, filled every category from real practices, and written the descriptions of sections 1798.106, 1798.115 and 1798.125.

## Used for these tasks

- [Draft or review a privacy policy and collection notice](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-or-review-a-privacy-policy-and-collection-notice.md)
- [Audit a client privacy policy for AI disclosures and chatbot labelling](https://ailawframework.com/practice/privacy-data-protection-and-cyber/audit-a-client-privacy-policy-for-ai-disclosures-and-chatbot-labelling.md)

## How AI may be used

AI may sort the client's data map into the category table and flag empty rows. The lawyer confirms the business is covered, writes the unopened-section descriptions, and checks every category against the last 12 months before publication.

**AI may:**

- Place the client's data-map entries into the category, source and purpose table
- Flag a row with no retention period and no criteria
- Compare this draft with the prior policy and list categories that were added or dropped

**AI must not:**

- Must not decide that the client is a business or state an adjusted revenue figure
- Must not draft the descriptions of sections 1798.106, 1798.115, 1798.120, 1798.125 or 1798.135
- Must not invent a 'Do Not Sell or Share' link label, or state that personal information is not sold if the data map does not say so

**The lawyer checks:**

- The business test in section 1798.140(d) has been applied, including the revenue threshold as adjusted, with no substituted dollar figure
- Every category, purpose, sale or share statement and retention period matches the last 12 months of practice
- The passages for sections 1798.106, 1798.115 and 1798.125 are the lawyer's, written from those sections, and the policy is updated at least every 12 months

## Authorities

- [California Civil Code § 1798.130 (privacy policy contents and timing of requests)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.130.&lawCode=CIV)
- [California Civil Code § 1798.100 (notice at collection and purpose limitation)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.100.&lawCode=CIV)
- [California Civil Code § 1798.140 (definitions, including business, personal information, sale and share)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV)
- [California Civil Code § 1798.110 (right to know)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.110.&lawCode=CIV)
- [California Civil Code § 1798.105 (right to delete)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105.&lawCode=CIV)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-ccpa-privacy-policy and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*