Is CalOPPA the same as the CCPA?

No. CalOPPA (2004) is a disclosure law with no size threshold: post a policy with certain contents. The CCPA (2020, amended by the CPRA) gives consumers substantive rights and applies only to businesses above its thresholds.

How should I answer the Do Not Track question?

Honestly. Most sites do not change behaviour in response to DNT signals, and it is lawful to say so. What CalOPPA requires is the disclosure.

Is it really free? Do I need an account?

Yes, and no. Every generator is free with no sign-up, watermark or paywall. Your answers stay in your browser; they are never sent to our server unless you use the optional AI clause writer or policy checker.

Is a generated policy legal advice?

No. PolicyForge produces a starting template from your answers. It cannot know every detail of your business or every law that applies to you. Read the whole document, replace every [bracketed] placeholder, make sure it describes what you actually do, and have a lawyer review it if you handle sensitive data, sell to children, or operate at scale.

CalOPPA Explained: Requirements, Checklist & Policy Generator

[Bracketed] fields are placeholders · Template, not legal advice

Who we are

This Privacy Policy explains how [Business name] ("we", "us", "our") collects, uses and shares personal information when you use [Website or app name] (the "website"), available at [website URL].

If you have any questions about this policy or your information, contact us:

Email: [contact email]
Postal address: [Business address]

Information we collect

Depending on how you use the website, we collect the following categories of personal information:

Contact details: name, email address, phone number.
Usage data: pages or screens viewed, features used, clicks, referring page, time and date of visits.
Device & log data: IP address, browser type, operating system, device identifiers, crash logs.
Cookies & similar tech: cookies, local storage, pixels and SDK identifiers.

We collect this information directly from you (when you fill in a form, create an account, buy something or contact us), automatically from your device when you use the website, and from the service providers listed below.

How we use your information

To provide, operate and maintain the website.
To create and manage your account.
To answer your questions and provide customer support.
To understand how the website is used and improve it.
To keep the website secure and to comply with our legal obligations.

How we share information

We do not share your personal information except as described here. We share it with service providers who process it on our behalf and only as needed to provide their services:

Google Analytics, for website and app analytics (privacy policy: https://policies.google.com/privacy).

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.

Cookies and tracking technologies

We and our partners use cookies and similar technologies on the website. Some third parties, such as analytics and advertising providers, may collect information about your online activities over time and across different websites when you use the website. See our Cookie Policy for details and for how to change your choices.

Do Not Track and opt-out preference signals

There is no common industry standard for "Do Not Track" (DNT) browser signals. The website currently [does not respond / responds in the following way] to DNT signals. [Confirm how your site actually behaves.]

Your choices

You can ask us to access, update or delete the personal information we hold about you by contacting [contact email]. You can also review and change your account information at any time in your account settings.

How long we keep information

We keep personal information as long as your account is active, and afterwards only as long as we need it for the purposes above or to meet legal, tax or accounting obligations.

How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The website is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Effective date" below, and if the changes are significant we will notify you by email or by a notice on the website before they take effect.

Effective date

This Privacy Policy is effective as of [Effective date].

Who CalOPPA covers

The California Online Privacy Protection Act (Business and Professions Code §§ 22575–22579) took effect in 2004. It applies to any operator of a commercial website or online service, including mobile apps, that collects personally identifiable information about individual consumers residing in California. An email address, name or phone number is enough. Where the operator is based doesn't matter.

What the policy must include (§ 22575(b))

Identify the categories of personally identifiable information collected and the categories of third parties it may be shared with. Describe the process, if any, for consumers to review and request changes to their information. Describe how consumers will be notified of material changes. State the effective date. Disclose how the site responds to web browser "Do Not Track" signals or similar mechanisms, and whether other parties may collect personally identifiable information about consumers' online activities over time and across different sites when they use yours. (The Do Not Track disclosures were added by AB 370 in 2013.)

The policy must be "conspicuously posted": for a website, for example, a link on the home page containing the word "privacy" in a way that stands out. The California Attorney General's guide "Making Your Privacy Practices Public" gives practical recommendations.

Enforcement

An operator violates CalOPPA if it fails to post a compliant policy within 30 days of being notified of non-compliance, or if it knowingly and wilfully, or negligently and materially, fails to follow its own posted policy. The Attorney General enforces it under California's Unfair Competition Law.

CalOPPA: the California Online Privacy Protection Act