A California site that collects names, emails or phone numbers links its privacy policy from the homepage

What the source requires

California requires the operator of a commercial website that collects personally identifiable information — a name, an email address, a telephone number — from California residents to post a privacy policy conspicuously: on the homepage, or through a link there containing the word "privacy". The policy must identify its effective date. There is no size or revenue threshold. A missing policy becomes a violation if it is still missing 30 days after the operator is notified.

Why this is hard to satisfy

A practice's site is a template with a contact form and a booking widget; the footer the template shipped with often has no privacy link at all, and nobody connects "we added a form" with "we now owe a privacy policy".

What we do about it

Where any crawled page has a form asking for a name, email or phone number, look on the homepage for a link whose text or label contains "privacy" (the statute's own test) and report its absence; where the policy is on the site and readable, report a policy that gives no effective date. Bounded: §22577(b) accepts other conspicuous forms a pattern cannot judge, the scan sees the homepage it was served, and the statute makes absence a violation only after notice, so the finding says the link was not found, never that the practice is in violation.

In build · phase one