Does a business have to provide a “notice at collection” to a consumer if the business does not collect information directly from them?


The CCPA requires that a business that collects a consumer’s personal information provide the consumer “at or before the point of collection” certain information regarding what will be collected, the purpose of the collection, the business’s sale practices, and where the consumer can find the business’s privacy notice.1

The regulations implementing the CCPA clarify that the requirement to provide a “notice at collection” only applies, however, when a business collects personal information “from the consumer.”2 In situations in which a business collects personal information about a consumer, but collects the personal information from a third party, the regulations implementing the CCPA make clear that the business “does not need to provide a notice at collection” so long as the business does not intend to sell the personal information.3 If the business intends to sell the personal information, a notice at collection is still not required if the business complies with California’s rules regulating data brokers.4