Home / Sources
Sources and method
Every law-specific clause in our generators is tied to a provision in a statute, regulation or official regulator guidance. This page lists them.
What PolicyForge is, and isn't
PolicyForge is a free template generator. It turns your answers into a first draft using fixed clauses written in plain English. It is not a law firm, it does not give legal advice, and using it does not create a lawyer-client relationship. The documents are templates: they cannot know every detail of your business, and laws change. Read every clause, replace every [bracketed] field and have a qualified lawyer review your documents if the stakes are high (sensitive data, children, health, finance, or significant scale).
The optional AI features (the clause writer and the policy checker) use a language model through Vercel AI Gateway. AI output can be wrong; treat it as a suggestion to verify.
Privacy laws
EU General Data Protection Regulation (Regulation (EU) 2016/679)
Organisations in the EU, and organisations outside it that offer goods or services to, or monitor the behaviour of, people in the EU (Art. 3). The UK keeps a near-identical "UK GDPR".
California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.)
For-profit "businesses" that collect Californians' personal information and meet one threshold in § 1798.140(d): annual gross revenue above $26,625,000 (the 2025 CPI-adjusted figure announced by the CPPA), buying/selling/sharing personal information of 100,000+ consumers or households, or earning 50%+ of revenue from selling or sharing it.
California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579)
Any operator of a commercial website or online service (including apps) that collects personally identifiable information from California residents, wherever the operator is based. There is no revenue threshold.
Personal Information Protection and Electronic Documents Act (Canada)
Private-sector organisations that collect, use or disclose personal information in the course of commercial activity in Canada (Alberta, B.C. and Québec have their own substantially similar laws for activity inside the province).
Other rules referenced
- FTC: Guides Concerning Use of Endorsements and Testimonials (16 CFR Part 255)
- FTC: Disclosures 101 for Social Media Influencers
- FTC: Mail, Internet, or Telephone Order Merchandise Rule (16 CFR Part 435)
- FTC: Children's Online Privacy Protection Rule (COPPA)
- Directive 2002/58/EC (ePrivacy), Article 5(3)
- Directive 2011/83/EU (Consumer Rights Directive)
- UK ICO: Guide to cookies and similar technologies
- UK ICO: Lawful basis for processing
- Apple App Store Review Guidelines, 5.1.1
- Google Play: User Data policy
Last reviewed
September 2026. The CCPA revenue threshold ($26,625,000) is the figure the California Privacy Protection Agency announced for 2025; the Agency adjusts it for inflation every other year.