California
California Online Privacy Protection Act (CalOPPA)
California’s website privacy policy law. Applies to any website that collects personal information from California residents, whatever the business size.
- Status
- In effect since July 1, 2004
- Citation
- Cal. Bus. & Prof. Code §§ 22575–22579
- Official text
- Read the law(opens in a new tab)
Who it covers
Any website or online service that collects personal information from California residents.
What it asks of your website
- Post a privacy policy, linked clearly from the homepage.
- List the kinds of personal data collected and the kinds of third parties it’s shared with.
- Say how the site responds to “Do Not Track” and similar browser signals, and whether other companies (ads, analytics, maps) collect data across sites.
- Show the policy’s effective date and explain how changes are announced.
Who has to comply: almost every website
CalOPPA has applied since July 1, 2004 to any operator of a commercial website or online service that collects personally identifiable information from California consumers, such as a name, email address or phone number. There’s no size threshold, and the site doesn’t have to be based in California. A company that only hosts or manages a site it doesn’t own isn’t the operator.
What the privacy policy must say
- The categories of personal information you collect, and the categories of third parties you share it with.
- How visitors can review and request changes to their information, if you offer that.
- How you tell visitors about material changes to the policy.
- The policy’s effective date.
- How you respond to browser Do Not Track signals and similar mechanisms (or a clear link to the protocol you follow).
- Whether other parties, such as ad and analytics companies, may collect personal information about visitors’ activity over time and across sites.
Posting it “conspicuously”
The policy counts as conspicuously posted if it’s on the homepage, or linked from the homepage by an icon or text link that contains the word “privacy” and stands out (capitals, larger type or a contrasting color), or by any other link a reasonable person would notice.
The California Attorney General’s recommendations
The Attorney General’s 2014 guide, Making Your Privacy Practices Public, isn’t binding, but it recommends plain language and a layered format, a clearly labeled section on online tracking that describes how you respond to Do Not Track, retention periods for each type of data, the choices visitors have, a contact for questions, and version control.
Enforcement
A violation happens if an operator fails to post a compliant policy within 30 days of being notified, and acts knowingly and willfully, or negligently and materially. The Attorney General enforces it through California’s Unfair Competition Law, which the Attorney General has described as allowing penalties of up to $2,500 per violation. In 2012 the Attorney General sent notices to app makers without policies, and in 2016 launched an online form for reporting sites that break the law.
Where GoConsent helps
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does CalOPPA apply to small websites?
Yes. Any commercial site that collects personally identifiable information from Californians must post a policy; there’s no size threshold.
Do I have to honor Do Not Track?
No, but your privacy policy must say how you respond to it.
Where should the privacy link go?
On the homepage, using the word “privacy” in a way that stands out.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
