What counts as "selling" or "sharing"?

Selling is disclosing personal information to a third party for money or other valuable consideration. Sharing is disclosing it for cross-context behavioural advertising, whether or not money changes hands. Advertising pixels and retargeting cookies commonly fall under sharing.

Do I have to honour Global Privacy Control?

Yes, if you sell or share personal information and the CCPA applies to you. Section 7025 of the regulations requires businesses to treat opt-out preference signals such as GPC as a valid request to opt out of sale and sharing.

How often must a CCPA privacy policy be updated?

At least once every 12 months (Civil Code § 1798.130(a)(5)), and the policy must show the date it was last updated.

Is it really free? Do I need an account?

Yes, and no. Every generator is free with no sign-up, watermark or paywall. Your answers stay in your browser; they are never sent to our server unless you use the optional AI clause writer or policy checker.

Is a generated policy legal advice?

No. PolicyForge produces a starting template from your answers. It cannot know every detail of your business or every law that applies to you. Read the whole document, replace every [bracketed] placeholder, make sure it describes what you actually do, and have a lawyer review it if you handle sensitive data, sell to children, or operate at scale.

CCPA Privacy Policy Generator – CPRA Compliant Template

[Bracketed] fields are placeholders · Template, not legal advice

Who we are

This Privacy Policy explains how [Business name] ("we", "us", "our") collects, uses and shares personal information when you use [Website or app name] (the "website"), available at [website URL].

If you have any questions about this policy or your information, contact us:

Email: [contact email]
Postal address: [Business address]

Information we collect

Depending on how you use the website, we collect the following categories of personal information:

Contact details: name, email address, phone number.
Usage data: pages or screens viewed, features used, clicks, referring page, time and date of visits.
Device & log data: IP address, browser type, operating system, device identifiers, crash logs.
Cookies & similar tech: cookies, local storage, pixels and SDK identifiers.

We collect this information directly from you (when you fill in a form, create an account, buy something or contact us), automatically from your device when you use the website, and from the service providers listed below.

How we use your information

To provide, operate and maintain the website.
To create and manage your account.
To answer your questions and provide customer support.
To understand how the website is used and improve it.
To keep the website secure and to comply with our legal obligations.

How we share information

We do not share your personal information except as described here. We share it with service providers who process it on our behalf and only as needed to provide their services:

Google Analytics, for website and app analytics (privacy policy: https://policies.google.com/privacy).

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different privacy policy.

Cookies and tracking technologies

We and our partners use cookies and similar technologies on the website. Some third parties, such as analytics and advertising providers, may collect information about your online activities over time and across different websites when you use the website. See our Cookie Policy for details and for how to change your choices.

Do Not Track and opt-out preference signals

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information for that browser. There is no common industry standard for older "Do Not Track" (DNT) browser signals, and we [do / do not] respond to them. [Confirm how your site actually behaves.]

California privacy rights (CCPA / CPRA)

This section applies to California residents. In the preceding 12 months we have collected the following categories of personal information, as defined in the California Consumer Privacy Act:

Category (CCPA)	Examples	Disclosed for a business purpose to
Identifiers	name, email address, phone number	Service providers listed above
Internet or other electronic network activity	pages or screens viewed, features used, clicks, referring page, time and date of visits	Service providers listed above
Identifiers; internet or network activity	IP address, browser type, operating system, device identifiers, crash logs	Service providers listed above
Internet or other electronic network activity	cookies, local storage, pixels and SDK identifiers	Service providers listed above

We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA.

You have the right to:

Know what personal information we have collected about you, including the categories, sources, purposes and the categories of third parties we disclose it to, and to receive a copy of specific pieces of information.
Delete personal information we collected from you, subject to certain exceptions.
Correct inaccurate personal information.
Opt out of the sale or sharing of your personal information.
Limit the use of sensitive personal information, where we use it for purposes beyond those allowed by the regulations.
Not receive discriminatory treatment for exercising any of these rights.

To make a request, email [contact email]. We will verify your request by matching information you give us with information we hold. You may use an authorised agent to make a request on your behalf; we may ask for proof of the agent's authority.

We keep each category of personal information only as long as described under "How long we keep information".

Reviewing and changing your information

You can review and update the information in your account at any time from your account settings, or ask us to do it for you by email.

How long we keep information

We keep personal information as long as your account is active, and afterwards only as long as we need it for the purposes above or to meet legal, tax or accounting obligations.

How we protect information

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The website is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Effective date" below, and if the changes are significant we will notify you by email or by a notice on the website before they take effect.

Effective date

This Privacy Policy is effective as of [Effective date].

Who the CCPA applies to

The CCPA applies to for-profit businesses that do business in California, collect consumers' personal information and meet at least one threshold in Civil Code § 1798.140(d): annual gross revenue over $25 million, adjusted for inflation (the California Privacy Protection Agency set it at $26,625,000 from January 2025); buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50% or more of annual revenue from selling or sharing personal information.

Most small websites fall below all three thresholds. They are still covered by CalOPPA, which has no threshold, so the generator keeps CalOPPA on.

What the privacy policy must contain

Section 7011 of the CCPA regulations (Cal. Code Regs. tit. 11) says the privacy policy must describe the business's online and offline practices, including the categories of personal information collected in the preceding 12 months, their sources, the purposes, the categories disclosed to third parties, and whether information is sold or shared. It must explain the rights to know, delete, correct, opt out of sale/sharing and limit use of sensitive personal information, and the right not to be discriminated against; how to submit requests and how they are verified; how authorised agents can act; how opt-out preference signals are processed; and the date it was last updated. It must be printable, available in the languages the business ordinarily uses, and linked conspicuously with the word "privacy".

CCPA Privacy Policy Generator