What California privacy rules ask of a website

The rights it creates

A California resident can ask what personal information you hold about them, ask you to delete it, and ask you to correct it.

They can also opt out of their information being sold or shared for cross context advertising, which is the right behind the link people recognize.

And they cannot be treated worse for exercising any of those rights, such as being shown a worse price.

• To know what personal information you hold about them
• To have it deleted
• To have it corrected
• To opt out of its sale or sharing for cross context advertising
• To limit the use of certain sensitive information
• Not to be treated worse for exercising any of these

Who it reaches

It applies to for profit businesses doing business in California that meet at least one threshold. The thresholds involve annual revenue, the number of consumers whose information is handled, or revenue from selling or sharing personal information.

A local firm with a contact form and a few hundred enquiries a year is usually far below all of them.

Doing business in California is broader than having an office there, which is why out of state firms have to check rather than assume.

The thresholds are the part worth checking rather than assuming, because they are set at a level most single-location businesses never approach. Assuming you are covered and assuming you are not are equally unhelpful.

The opt out link

The familiar link exists because of the sale and sharing right. If you do neither, there is generally nothing to opt out of and no link required.

Sharing has a specific meaning around cross context behavioral advertising, so a site running advertising pixels may be doing it without having thought so.

This is a good reason to know exactly which third party scripts your pages load.

The definition of sharing is the trap. It covers cross context behavioral advertising, which means a site running an advertising pixel may be doing it without anybody having decided to.

What a notice has to cover

Where it applies, visitors need to be told what categories of information are collected, why, how long it is kept, and what rights they have.

They also need a route to make a request, and you need a way to verify that the person asking is who they say they are.

That verification step is the one small businesses forget, and it is the one that protects you from handing data to the wrong person.

Why this affects sites outside California

The rules follow the resident rather than the business. A firm anywhere in the country can find itself handling the data of California residents.

Several other states have since passed their own laws with similar shapes and different details.

The practical effect is that a single clear standard applied everywhere is easier than tracking which visitor is covered by what.

Several other states now have their own versions with similar rights and different thresholds, which is the argument for one clear standard applied everywhere.

The sensible posture for a small site

Collect less. Say plainly what you collect and why. Give people a working way to ask for their data or its deletion, and answer promptly.

Keep a short list of third parties, because the hardest questions all come from things you loaded onto your own page.

Do that and most state rules are substantially handled, whichever ones turn out to apply.

Most of it comes down to collecting less and saying plainly what you collect, which is the inventory in what your website collects.

Where we stop

We will not tell you whether a threshold applies to your business, and nothing here is legal advice. That depends on facts about your revenue and your data.

What the builder does is keep your privacy page readable and reachable, and publish it exactly as you wrote it.

Every page passes a check that runs before anything publishes, validated against Google Search Essentials and modern web standards, and the default is to add nothing to a visitor's browser.