Is a privacy policy required by law in the United States?

There is no single federal US privacy law, but several states have their own requirements. California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA, and others require privacy notices for businesses meeting certain thresholds. Many industry regulations (COPPA, HIPAA, GLBA) also mandate privacy policies.

What is the CCPA and who does it apply to?

The California Consumer Privacy Act (CCPA) applies to for-profit businesses that collect personal data from California residents AND meet at least one threshold: annual gross revenue over $25 million, buying/selling data of 100,000+ consumers, or deriving 50%+ of revenue from selling consumer data.

What rights do US consumers have under CCPA?

California consumers have the right to know what data is collected, the right to delete their data, the right to opt out of the sale of their data, and the right to non-discrimination for exercising these rights. The CPRA (effective 2023) added the right to correct inaccurate data and limit sensitive data use.

Free US Privacy Policy Generator (CCPA)

The California Consumer Privacy Act (CCPA), as amended by the CPRA, is the most comprehensive state-level privacy law in the United States. It took full effect on January 1, 2023, and continues to evolve.

Does the CCPA apply to your business?

CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of these thresholds:

Annual gross revenue exceeding $25 million
Buy, sell, or share the personal information of 100,000 or more consumers, households, or devices annually
Derive 50% or more of annual revenue from selling or sharing consumers' personal information

Key rights CCPA grants to consumers:

Right to know — what personal information is collected, used, shared, or sold
Right to delete — request deletion of personal information held by businesses
Right to opt-out — of the sale or sharing of personal information
Right to non-discrimination — businesses cannot penalize consumers for exercising their rights
Right to correct — inaccurate personal information
Right to limit use — of sensitive personal information

Other US state privacy laws to consider:

Virginia (VCDPA) — similar rights framework, effective January 2023
Colorado (CPA) — opt-out rights and data protection assessments, effective July 2023
Connecticut, Utah, Texas, Oregon, Montana — additional states with comprehensive privacy laws now in effect

Tip: Even if your business does not meet the CCPA thresholds, having a clear privacy policy is a best practice and may be required under other laws such as CalOPPA (California Online Privacy Protection Act), which applies to any website or app that collects personal information from California residents, regardless of business size.

What This Privacy Policy Generator Creates

This tool generates a US Privacy Policy covering federal requirements enforced by the FTC and key state privacy laws including the California Consumer Privacy Act (CCPA) and Children's Online Privacy Protection Act (COPPA). A Privacy Policy is legally required for any website or app that collects personal information — and is contractually required by Google AdSense, Apple App Store, Google Play, Stripe, PayPal, and virtually every payment processor and ad network.

Your generated Privacy Policy will cover: what personal information is collected (name, email, device identifiers, IP address, usage data), the purposes for collection, how data is stored and protected, when data is shared with third parties (analytics, advertising, payment processors), user rights under CCPA (right to know, delete, and opt out of sale), COPPA compliance for children's privacy, cookie usage disclosure, and how users can contact you regarding privacy concerns.

FTC enforcement: The FTC actively enforces against deceptive privacy practices under Section 5 of the FTC Act. A Privacy Policy that accurately describes your data practices is your primary compliance document. Businesses that collect data but have no Privacy Policy — or whose policy misrepresents their practices — face FTC investigation and civil penalties.

Generated entirely in your browser. Your business details are never transmitted to our servers. Download as a formatted document or copy the text directly.