CalOPPA privacy policy: posted, findable and complete

The rule

The statute is quoted as the California Attorney General reproduced it in the appendix to its 2014 guide. The legislature’s own site blocked automated access, so check the current wording on leginfo.legislature.ca.gov before relying on a quotation.

The guide explains the scope. Personally identifiable information includes a name, an email address and “any other identifier that permits the physical or online contacting of a specific individual”, which can take in passively collected data such as a device identifier. It describes the standard for failing to follow the policy requirements, or an operator’s own policy, as “either knowingly and willfully or negligently and materially”. And it says “there is no legal requirement for how operators of web sites or online services must respond to a browser’s DNT signal”. The duty is to say what you do.

On availability, the guide recommends “a conspicuous link on your homepage containing the word ‘privacy’”, made conspicuous by larger type, contrasting color or symbols, and a link “on every web page where personal information is collected”. These are recommendations, not statute wording.

The Attorney General’s 2012 suit against Delta, announced as the first legal action under the statute, alleged an app with no policy and sought “penalties of up to $2,500 for each violation”. The announcement adds that operators who do not follow their stated policies can be prosecuted under the Unfair Competition Law or False Advertising Law. The California Privacy Protection Agency’s more recent decision against Tractor Supply rests on the California Consumer Privacy Act, and its page does not mention CalOPPA. The CCPA has its own content rules for privacy policies, which this page does not cover; US-05 and US-11 deal with them.

The check’s own citation, section 22575 and 15 U.S.C. § 45, stands. This page adds sections 22576 and 22577, which set when a failure is counted and define the terms. One point of wording is corrected: the law requires a disclosure about Do Not Track, not that the site honour it.

What PeekWell checks and how

US-13 asks two questions. Is there a privacy policy that a visitor can reach? And does its text appear to cover the points the law lists, including how the site treats Do Not Track?

The scan is automated. The first part is the same as EU-09 and UK-10: it looks for the privacy policy the way a visitor would, from the footer and menus of your public pages, and notes whether it opens and how easy it is to reach. The second part reads the policy for the points section 22575(b) lists, including a Do Not Track statement, and the report says which ones the text appears to cover.

A policy can cover a point in its own words, so a gap in the report is a reason to read the policy again, not a conclusion.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It does not port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. The check applies to any site open to US visitors. It cannot see what a company does with data after collection, so whether the policy is true is outside it; see US-04 and US-07. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

Section 22575(a) counts a failure to post only if the policy is still missing 30 days after notice, so the law gives a company a chance to put this right first. The Delta case shows the sequence: Delta had been among the companies given 30 days, and it was named in the lawsuit that followed. The announcement reports no result.

In Tractor Supply the agency’s allegations put a policy that did not tell people their rights alongside an opt-out that did not work, and the settlement was $1,350,000 with a corporate officer or director certifying compliance each year for four years. It is a different statute from CalOPPA, but it starts where this check does: the policy has to exist and say what the company does.

The FTC route matters most where a policy says more than the company does. Its 1Health.io complaint alleged a retroactive widening of sharing and deletion promises that were not kept. In the Director’s words, “The FTC Act prohibits companies from unilaterally applying material privacy policy changes to previously collected data.”

For a company the practical consequences are of three kinds. The policy is a public statement, so it can later be compared with what the site does. A policy that predates a new tool no longer describes the site, and changing it later does not reach back over data already collected.

Smaller companies and larger companies

The statute has no size threshold. It reaches any operator that collects personal information from Californians.

In a small company the policy is often a generator template added at launch. Then a newsletter tool, an analytics script and an advertising pixel are added, and the policy still lists the original tools. The Do Not Track statement is an easy one to miss, because it was added to the statute in 2013, after many policies were written. The FTC’s proposed 1Health.io order included a $75,000 payment for refunds and a bar on sharing health data without affirmative express consent.

In a larger company the problem is breadth. Several brands, apps and regional sites may each carry their own policy or none, and a legal team’s policy can lag behind what marketing and product deploy. The Delta suit concerned a mobile app, a reminder that apps and other online services are in scope as well as websites. The guide recommends posting the policy where people download the app and linking it inside the app.

How to fix it

1. Link the policy from every page. Put a link labelled “Privacy” or “Privacy policy” in the shared footer, with good contrast. Add one beside each form that collects personal information.
2. List what you collect and who gets it. Write down the categories of information collected and of third parties it may be shared with, checked against the tools installed today, not at launch.
3. Describe the review process and the changes. If people can ask to see or correct their information, say how. Say how you tell people about material changes, and put the effective date at the top.
4. Add a Do Not Track section. Give it a clear heading. Say how the site responds to a browser’s Do Not Track signal, or link to a program that offers the choice and explain its effects. Say whether other parties, such as advertising or analytics vendors, may collect information about visitors.
5. Make the policy match the site. Check that the site does what the policy says about sharing, deletion and security. If you widen sharing, tell the people whose data you already hold first.
6. Re-scan. Run a scan again. The reachability finding should disappear once the policy opens from every page, and the content finding should disappear once the text covers each point above.

<footer>
  <a href="/privacy/">Privacy policy</a>
</footer>

Whether a policy meets the statute is a matter for your legal adviser, and Peeky reports only what it sees and reads.