| name | ccpa-policy |
| title | CCPA/CPRA Privacy Policy |
| description | Drafts a CCPA/CPRA-compliant privacy policy covering all required statutory disclosures under Cal. Civil Code §§ 1798.100–1798.199. Use when drafting or updating a California privacy policy, CCPA compliance notice, or consumer privacy disclosure for a business meeting CCPA applicability thresholds. |
| author | CaseMark |
| author_url | https://github.com/CaseMark/skills/tree/main/skills/legal/ccpa-policy |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
CCPA/CPRA Privacy Policy
Generates a California Consumer Privacy Act / California Privacy Rights Act compliant privacy policy with all required statutory disclosures.
Quick Start
Gather before drafting:
- Applicability trigger — ≥$25M revenue, ≥100K consumer records bought/sold/shared, or ≥50% revenue from selling/sharing PI
- Data inventory — categories collected (per § 1798.140), sources, retention periods
- Purpose map — business/commercial purpose per data category
- Third-party sharing — service providers, contractors, ad networks, affiliates; distinguish business-purpose disclosure from sale/sharing
- SPI flag — whether sensitive personal information (§ 1798.121) is collected and right-to-limit applies
- Children's data — actual knowledge of collection from consumers under 16
- Request channels — minimum two methods (toll-free number + web URL required)
- Contact details — legal name, mailing address, privacy contact, DPO/CPO if appointed
Policy Sections
Draft each section in order:
1. Introduction
Effective date, scope (California residents), applicable threshold, governing law (CCPA as amended by CPRA + CPPA regulations).
2. Personal Information Collected
| Statutory Category (§ 1798.140) | Examples | Sources |
|---|
| Identifiers | Name, email, IP, account ID | Direct, automated |
| Commercial information | Purchase history, preferences | Direct, transaction systems |
| Internet/network activity | Browsing, search, interactions | Automated (cookies, pixels) |
| Geolocation | Precise physical location | App/device |
| Professional/employment | Job title, employer | Direct |
| Inferences | Profiles, characteristics | Internal analytics |
| Sensitive PI | SSN, financial, health, biometric | Per § 1798.121 |
Populate from data inventory. Omit inapplicable rows.
3. Use Purposes
Map each purpose to its data categories:
- Transaction fulfillment and services
