Short answer: If your website collects personal information about people in California, such as through a contact form, California’s CalOPPA asks you to post a privacy policy and follow it. The CCPA adds more duties, but only for businesses that pass one of its tests, such as over $25,000,000.00 in revenue. Your policy should say what you collect, why, who receives it, the choices people have, how you respond to Do Not Track and who to contact.
It isn’t legal advice: confirm your case with your lawyer.
When a small business needs one
CalOPPA applies to operators of commercial websites and online services that collect personally identifiable information about Californians. It asks them to post a privacy policy where people can see it and to comply with it.
Since 2013, CalOPPA also asks you to tell people how your site responds to a browser’s Do Not Track signal. The Attorney General’s guide adds that its recommendations are not regulations or legal opinions.
From the California Attorney General, “Making Your Privacy Practices Public” (May 2014), read November 2, 2026.
The CCPA: who it covers
| CCPA test | Covered if |
|---|---|
| The kind of business | For-profit and doing business in California |
| Gross annual revenue | Over $25,000,000.00 |
| California residents or households whose data you buy, sell or share | 100,000 or more |
| Revenue from selling California residents’ personal information | 50% or more |
| Nonprofits and government agencies | Generally not covered |
A business the CCPA covers has more work: answering people’s requests to exercise their rights and giving them notices about its privacy practices.
From the California Attorney General, “California Consumer Privacy Act (CCPA)”.
What to include
- Say what personal information you collect and how you use it beyond completing a sale or running your site.
- Name who receives it, and link to their privacy policies when you can.
- Give tracking its own labeled section, and describe how you respond to a browser’s Do Not Track signal.
- Say whether other parties collect personal information while people are on your site.
- Describe the choices people have about the collection, use and sharing of their information.
- Write in plain language, without legal jargon, and in a format that is easy to scan.
- Give the effective date, and tell people whom to contact with questions or concerns.
From the California Attorney General, “Making Your Privacy Practices Public”.
What our own policy shows
Our privacy policy was last updated on October 28, 2026, and takes effect that day. It runs to 21 sections, from what we collect and why to the tracking on our site, your rights and how to contact us.
It answers the Do Not Track question in one line: we don’t respond to that setting, and we honor Global Privacy Control. We treat Global Privacy Control as a request to opt out of the sale or sharing of data for advertising, whether or not a law requires it.
Before you publish your privacy policy
- It lists every form, tool and partner that collects data on your site.
- It explains why you collect each kind of data.
- Tracking has its own section, with your Do Not Track answer.
- It describes the choices people have and how to use them.
- It shows the effective date and a contact.
- A link to it appears on every page, usually in the footer.
RememberPost a policy that matches what your site does. A small site with a contact form can fall under CalOPPA long before it reaches any of the CCPA’s tests.
Accessibility is a separate rule; our guide to ADA website compliance covers it. For a site built with both in mind, see our web design service.
Quick answers about website privacy policies
Do I need a privacy policy on my website?
If your website collects personal information about people in California, such as through a contact form, CalOPPA applies. It asks you to post a privacy policy where people can find it and to follow it, whatever the size of your business.
Does the CCPA apply to my small business?
Only if your for-profit business does business in California and meets one test: over $25,000,000.00 in gross annual revenue, the data of 100,000 or more California residents or households, or half its revenue from selling their data.
Is CalOPPA only for businesses in California?
The Attorney General’s guide says it applies to operators of commercial websites that collect personally identifiable information about Californians. A business elsewhere can collect that information through its website, so check with your lawyer.
Do I have to honor Do Not Track?
CalOPPA asks you to say how you respond to a browser’s Do Not Track signal. Our own policy says we don’t respond to it, and that we honor Global Privacy Control as a request to opt out.
Can I use a privacy policy template?
A template can help you start, but CalOPPA asks you to say what you do and do what you say. Change it until it describes your own forms, tools and partners, and keep it current.
Sources
Read on November 2, 2026. California Attorney General: Making Your Privacy Practices Public (May 2014) and California Consumer Privacy Act (CCPA). Our own case: our privacy policy, last updated October 28, 2026.