- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
Does a business have to provide a “notice at collection” to a consumer if the business does not collect information directly from them?
No.
The CCPA requires that a business that collects a consumer’s personal information provide the consumer “at or before the point of collection” certain information regarding what will be collected, the purpose of the collection, the business’s sale practices, and where the consumer can find the business’s privacy notice.1
The regulations implementing the CCPA clarify that the requirement to provide a “notice at collection” only applies, however, when a business collects personal information “from the consumer.”2 In situations in which a business collects personal information about a consumer, but collects the personal information from a third party, the regulations implementing the CCPA make clear that the business “does not need to provide a notice at collection” so long as the business does not intend to sell the personal information.3 If the business intends to sell the personal information, a notice at collection is still not required if the business complies with California’s rules regulating data brokers.4