US-CaliforniaDoes CalOPPA require websites to post a privacy policy?
Yes, CalOPPA requires commercial websites and online services that collect personal information from California residents to post a conspicuous privacy policy.
What the Law Says
The California Online Privacy Protection Act (CalOPPA) is the first state law in the U.S. requiring websites and online services to post a privacy policy.
CalOPPA applies to any operator of a commercial website or online service that collects personally identifiable information (PII) from California residents — even if the business is located outside California.
The law defines 'operator' broadly to include any person or entity that owns or operates a website or online service for commercial purposes and collects PII from consumers who visit the site or use the service.
A privacy policy must be 'conspicuous' — meaning it must be easily found, typically via a link labeled 'Privacy Policy' on the homepage and any page where PII is collected.
The policy must disclose what categories of PII are collected, how the information is used, with whom it is shared, and how users can review or request changes to their information.
Statutory TextAn operator of a commercial website or online service that collects personally identifiable information through the website or online service from a consumer residing in California shall conspicuously post its privacy policy on its website.
— Cal. Bus. & Prof. Code § 22575(a) — Posting of privacy policy
Statutory TextThe privacy policy shall identify the categories of personally identifiable information that the operator collects… and the categories of third parties with whom the operator may share that information.
— Cal. Bus. & Prof. Code § 22575(b)(1) — Required disclosures
Statutory TextIf the operator makes any material changes to its privacy policy, the operator shall notify consumers… within 72 hours after posting the revised policy.
— Cal. Bus. & Prof. Code § 22575(b)(5) — Notification of changes
What to Do
Identify whether your website or online service collects PII from California residents (e.g., name, email, address, phone number, IP address, cookies).
Draft a privacy policy that complies with CalOPPA’s required disclosures under § 22575(b).
Post a clearly labeled, clickable 'Privacy Policy' link on your homepage and every page where PII is collected.
Update your policy promptly when practices change, and notify users within 72 hours of posting the update.
Review compliance annually — especially if you use third-party tracking tools, ad networks, or analytics services.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.