California Online Privacy Protection Act
CalOPPA
Comprehensive privacy · Other
The first U.S. state law requiring commercial websites and online services to post a privacy policy. The policy must describe what personally identifiable information is collected, who it is shared with, and, since 2014, how the site responds to browser Do Not Track signals and whether third parties track users across sites.
- Where
- California
- Citation
- Cal. Bus. & Prof. Code 22575-22579
- Status
- In force
- In force since
- 2004-07-01
- Last amended
- 2014-01-01
- Enforced by
- California Attorney General and local prosecutors (through the Unfair Competition Law)
- People can sue
- No
- Penalties
- No penalty in the chapter itself; violations are pursued as unfair business practices (Bus. & Prof. Code 17200 et seq.), with civil penalties up to $2,500 per violation. An operator violates the posting duty only if it fails to post within 30 days after notice of noncompliance (22575(a)).
- Applies to
- Operators of commercial websites or online services (including mobile apps) that collect personally identifiable information from California residents (22575(a), 22577(c))
- Does not cover third parties that host or manage a site on the owner's behalf (22577(c))
What a privacy notice must say
- Conspicuously post a privacy policy (for online services, make it reasonably accessible).Cal. Bus. & Prof. Code 22575(a), 22577(b)
- Policy must list the categories of personally identifiable information collected and the categories of third parties it is shared with.Cal. Bus. & Prof. Code 22575(b)(1)
- Describe any process for consumers to review and request changes to their information, and how material policy changes are communicated; state the policy's effective date.Cal. Bus. & Prof. Code 22575(b)(2)-(4)
- Disclose how the operator responds to Do Not Track signals and whether other parties may collect information about a consumer's online activities over time and across sites.Cal. Bus. & Prof. Code 22575(b)(5)-(7)
Practices it requires
- Do not violate the posted policy knowingly and willfully, or negligently and materially.Cal. Bus. & Prof. Code 22576
Sources
- Official text
- Cal. Bus. & Prof. Code 22575 (California Legislative Information)
- Cal. Bus. & Prof. Code 22576
- Cal. Bus. & Prof. Code 22577
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Enforcement through Bus. & Prof. Code 17200/17206 and the $2,500 UCL penalty were not re-fetched for this entry. | Chapter-level official_url uses leginfo's chapter view (Division 8, Chapter 22) and was not separately fetched; section pages were fetched.
Research reference, not legal advice.