What is a CCPA notice at collection?

The notice at collection is the first thing the CCPA asks of a business, and it is easy to get wrong by treating the privacy policy as a substitute. It is not. The notice at collection is a specific, upfront disclosure the law requires you to give right where you gather someone's data, before or at the moment you collect it.

What is a notice at collection?

Under California Civil Code section 1798.100(a), a business that controls the collection of a consumer's personal information must, at or before the point of collection, tell that consumer what it is doing. Concretely, the notice states the categories of personal information to be collected and the purposes for which they are used, whether that information is sold or shared, and how long each category is kept. It is short and situational: the point-of-collection disclosure that sits next to the sign-up form, the app permission, or the checkout field.

What has to be in it?

Section 1798.100(a) breaks into three parts. First, the categories of personal information you collect and the purposes, plus whether that information is sold or shared. Second, if you collect sensitive personal information, that category and its purposes have to be called out separately, again with whether it is sold or shared. Third, the length of time you intend to keep each category, or if a fixed time is not possible, the criteria you use to decide. You describe the categories using the terms California sets in section 1798.140, so a reader can compare notices across businesses.

When and where must you give it?

At or before the point of collection. That timing is the whole point: a consumer should know what is being gathered before they hand it over, not discover it later buried in a policy. If you decide to collect a new category of personal information, or to use data you already hold for a new purpose that is incompatible with the one you disclosed, section 1798.100(a) requires you to give notice again before doing it. Silent scope creep is the violation the rule is built to stop.

How it differs from your privacy policy

A CCPA privacy policy is the long, comprehensive document you refresh every twelve months. The notice at collection is the brief disclosure at the moment of collection, and it typically links to the fuller policy. Both are required, and one does not replace the other. If you are still working out whether the CCPA reaches you at all, start with how the CCPA applies to your business, and if you sell or share data, pair this notice with a Do Not Sell or Share link. The notice is also what makes the downstream right to delete meaningful, because people can only ask you to erase data they were told you collected.

Next step

The notice at collection is small but load-bearing: get its timing or contents wrong and every downstream disclosure inherits the gap. The free 2-minute Obligation Scan checks whether the CCPA applies to you and lists the notices, links, and request-handling steps you owe, so a missing point-of-collection disclosure does not become an enforcement problem. The US state privacy laws hub shows how California's rules compare with other states.