California. Sectoral privacy. Act

CalOPPACalifornia Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Requires operators of commercial websites and online services collecting personally identifiable information from California residents to conspicuously post a privacy policy with specified content, including how they respond to Do Not Track signals.

Key themes

privacy policy
conspicuous posting
Do Not Track disclosure
third-party tracking

Unique features

Applies with no threshold to any operator, including mobile apps.

SaaS relevance

Any SaaS with a website or app used by Californians needs a compliant privacy policy.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: None
Maximum penalty: Up to $2,500 per violation under the Unfair Competition Law

§3Dates

Key dates

Adopted 12 September 2003
In force 1 July 2004
AB 370 (2013) added Do Not Track disclosure.

§4Text and authority

Text

Authoritative text leginfo.legislature.ca.gov

Authority

California Attorney General

§5Where it applies

Domestic law of: California

§6Sources and verification

Sources consulted

oag.ca.gov

Verification

Medium confidence.

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.