Notice at collection template

What a notice at collection is, and what this builds

California’s privacy law asks a business to tell people four things at or before the moment it collects their personal information: which categories it collects, why, whether it sells or shares them, and how long it keeps each one. The regulations call that the Notice at Collection and add two links to it: the opt-out page when anything is sold or shared, and the privacy policy. It is short on purpose. The regulations say it exists so that a person can decide, before handing anything over, whether to go ahead or to opt out.

This builder writes it from the statute’s own list of categories, ties each category to its purposes in a grid, and reads the six required parts back to you. Switch the place of collection and the notice changes shape: a slip beside a web form, a printed version with the web addresses written out, or a script to read out on the phone. Switch to GDPR and it writes the first layer of an Art. 13 notice instead. The notice is a summary of your privacy policy, so the two must say the same thing; for who the law covers at all, start with what the CCPA is.

How to use this notice at collection template

1. One notice per point of collection. A quote form, a checkout, an app sign-up and a shop counter collect different things. Build a notice for each, or one that honestly covers all of them.
2. List what the form actually takes. Open the form and count every field, plus what your tags read in the background (IP address, cookie IDs). A data map makes this a copy job rather than a guess.
3. Write the categories in your customer’s words. The category name is the statute’s; the line beside it is yours: “name, email and phone number”, not “identifiers”.
4. Use the retention periods you already decided. If you have none, set them first with the data retention policy template; the notice and the schedule must match.
5. Be straight about ad pixels. Letting an ad network read visitors’ data for targeted ads on other sites is “sharing” whether or not money changes hands. The “Do Not Sell or Share” link guide covers the page it points to.
6. Clear step 4, then copy. Copy the HTML into the page beside the form, or print it for the counter. Re-run it when the form gains a field.

Where the notice goes, place by place

The regulations give examples rather than one fixed spot. The test underneath all of them is that people meet the notice where they hand the information over, before they do.

Worked example: the solar installer's quote form

The pre-filled firm takes quote requests on its website. The form asks for a name, address, email, phone number, the monthly electricity bill and roof photos; an ad pixel on the page reads the IP address and cookie IDs; and a financing option asks for a social security number for the credit check. That is 5 categories, 5 purposes, and this table in the notice:

What the builder reads back: 6 of 6 required parts in place. 2 of the 5 categories are shared, because the pixel lets an ad network use the data for ads on other sites, so the notice carries the opt-out link. Sharing also means the firm has to treat an opt-out preference signal such as Global Privacy Control as an opt-out request; the GPC checker shows what a browser sends.

The social security number is sensitive personal information, used only for the credit check the customer asked for. That is the first use regs § 7027(m) lists, so the firm needs no Notice of Right to Limit. Read by phone instead, the same notice runs to about 250 words: roughly 1 min 40 s at an assumed 150 words a minute, which is why a call script names the categories in plain words and sends the detail to the web address.

Where a notice at collection falls short

• A link to the top of the privacy policy. Online, a link can stand in for the notice only if it lands on the section that holds the parts. Sending people to the start, so they scroll for it, does not meet the standard.

  regs § 7012(f)

• Category names and nothing else. Each category has to be written so a reader understands what is collected. “Commercial information” means little until it says “your electricity bill and the quotes we send”.

  regs § 7012(e)(1)

• “As long as necessary”. The notice gives how long each category is kept, or the criteria that set it where a period is not possible.

  regs § 7012(e)(4)

• A new field, the old notice. Collecting a new category, or using data for a purpose incompatible with the one disclosed, needs a new notice first.

  regs § 7002(f)

• The ad network left out. A third party that controls collection on your site gives its own notice, or the two of you give one that covers both.

  regs § 7012(g)(1)

• After the submit button. If the notice is not given at or before collection, the business may not collect.

  regs § 7012(d)

Jurisdiction notes

California. The notice is set by Civ. Code § 1798.100(a) and spelled out in regs § 7012. It covers people in California a business collects from, at each point of collection. The privacy policy is the long version and must agree with it.

EU and GDPR. Art. 13 asks for its items “at the time when personal data are obtained”. Where the data comes from someone else, Art. 14 gives a reasonable period, at the latest one month. The Article 29 Working Party’s transparency guidelines (WP260 rev.01, ¶¶ 35–36) support a layered notice whose first layer names the controller, the purposes and the rights, and links to the rest; that is the variant this builder writes. For the two laws side by side, see GDPR vs CCPA.

Other US states. Virginia’s law asks for a privacy notice with five items: categories processed, purposes, how to use the rights and appeal, the categories shared with third parties, and the categories of third parties (Va. Code § 59.1-578(C)). Its text does not set out a California-style notice at the point of collection. The Virginia guide and the state law table cover the rest.

Questions