CalOPPA

California Online Privacy Protection Act

A California state law that requires commercial websites and online services that collect personally identifiable information (PII) from California residents to post a conspicuous and easily accessible privacy policy on their website.

CalOPPA was enacted in 2003 and was the first law in the United States to require websites to have a privacy policy. The main goal of CalOPPA is to provide transparency and give consumers more control over their personal information. The law seeks to ensure that website operators inform users about the types of information they collect, how they use and share it, and how users can review and request changes to their stored data.

Under CalOPPA, the privacy policy must include the following information:

1. The types of personally identifiable information collected and the categories of third parties with whom this information may be shared.
2. The process, if any, by which users can review and request changes to their collected PII.
3. A description of how the website operator will notify users of changes to its privacy policy.
4. The effective date of the privacy policy.
5. A statement disclosing whether the website honors “Do Not Track” signals or similar mechanisms that allow users to opt out of online tracking.

Non-compliance with CalOPPA can result in penalties, including fines, and it may also damage the reputation of the website or online service.

Although CalOPPA is a California state law, it has broader implications for websites and online services based outside of California. Since the law applies to any site that collects PII from California residents, website operators from other states or countries should also comply with CalOPPA if they cater to users in California.

• Abbreviation: CalOPPA