A California state law enacted in 2003, the California Online Privacy Protection Act (CalOPPA) was the first of its kind in the United States to mandate that commercial websites and online services post a conspicuous and accessible privacy policy. The law aims to provide transparency and empower consumers with more control over their personal information. CalOPPA applies to any website or online service that collects Personally Identifiable Information (PII) from California residents, regardless of where the operator is based.
Privacy Policy Requirements
Under CalOPPA, a privacy policy must include specific details to ensure users are informed about their data. These details include:
- Information types: The types of PII collected and the categories of third parties with whom this information may be shared.
- Review process: The process, if any, by which users can review and request changes to their collected PII.
- Policy changes: A description of how the website operator will notify users of changes to its privacy policy.
- Effective date: The effective date of the privacy policy.
- Do Not Track: A statement disclosing whether the website honors "Do Not Track" signals or similar mechanisms that allow users to opt out of online tracking.
Compliance and Penalties
Non-compliance with CalOPPA can result in penalties, including fines, and may also damage the reputation of the website or online service. Website operators who fail to post their privacy policy within 30 days after being notified about noncompliance will be deemed in violation. Although CalOPPA is a California state law, its implications extend to websites and online services based outside of California, as it applies to any site that collects PII from California residents.
