CCPA/CPRA § 1798.100
General Duties of Businesses that Collect Personal Information
The Privisy audit tests this section. See the checks
- Source
- Statute
- In force from
- January 1, 2023
- Last reviewed
- September 2026
- Framework
- CCPA/CPRA
What it requires
Businesses that control personal information collection must notify consumers at or before the point of collection about: the categories collected, their purposes, and whether the information is sold or shared. Collection, use, and retention must be reasonably necessary and proportionate to disclosed purposes. Businesses must enter into compliant data-sharing agreements with service providers, contractors, and third parties, and implement reasonable security procedures.
Statute text
A business that controls the collection of a consumer's personal information shall, at or before the point of collection, inform consumers of the following: (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared.
California Consumer Privacy Act / California Privacy Rights Act, § 1798.100Read the full section from California Privacy Protection Agency (CalPrivacy)
How Privisy tests it
- Notice at Collection
- Policy: Data Categories Disclosure
- Policy: Collection Purposes
The audit runs these checks against your live site and shows the evidence behind every result.
Get Your AuditThis page is for information only and is not legal advice. The excerpt is reproduced from official public sources and was checked against them on the last-reviewed date above. Laws change: check the authoritative source and consult a licensed attorney for compliance guidance.