CalOPPA (California Online Privacy Protection Act)
The first U.S. state law (2003, effective 2004) requiring commercial sites to post a privacy policy at all — the reason a Privacy Policy link is now a near-universal footer element rather than an occasional courtesy. Its reach is broader than its name suggests: neither the site’s operator nor its servers need to be in California, only its audience — any site reachable by California residents is in scope, which in practice means most public U.S. sites.
Its reach is broader than its name suggests: neither the site’s operator nor its servers need to be in California, only its audience — any site reachable by California residents is in scope, which in practice means most public U.S. sites.
Post a conspicuous, complete privacy policy
The policy needs a “distinctive and easily found link,” conventionally labeled along the lines of “Your California Privacy Rights” — the direct precedent for Privacy Policy‘s footer-placement convention. It must disclose what categories of information are gathered, how that information may be shared with other parties, how a customer can review and change their stored information, and the policy’s effective date and revision history.
Disclose how Do Not Track signals are handled
An amendment added a specific disclosure requirement: the policy must state how the site responds to a browser’s Do Not Track signal, and whether it permits third parties to track a customer’s activity across other sites. A site doesn’t have to honor Do Not Track under CalOPPA — it has to say, plainly, whether it does.
A site doesn’t have to honor Do Not Track under CalOPPA — it has to say, plainly, whether it does.
Comply within the cure window
An operator found not to be posting a policy, or posting one that doesn’t meet the law’s disclosure requirements, has a 30-day cure period after notification before facing legal action — a grace period for fixing the omission rather than an instant violation.
Related Concepts
Patterns
Standards
- Fair Information Practices
- CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)
Further reading
The California Attorney General’s Making Your Privacy Practices Public (California Department of Justice, 2014 — copying permitted with attribution and free distribution, but no open license; https://oag.ca.gov/sites/all/files/agweb/pdfs/cybersecurity/making_your_privacy_practices_public.pdf) turns the disclosure duties above into formatting recommendations from the office that enforces them, such as giving the Do Not Track disclosure its own clearly labeled section that describes the site’s actual response.
Sources
California Online Privacy Protection Act (Wikipedia) is this page’s sole source — the law’s broad reach based on audience location rather than operator location, the required policy disclosures, the Do Not Track amendment, and the 30-day cure period are all drawn directly from it.