Does CCPA / CPRA apply to you?
You do business in California and either gross over $25 million a year, handle the personal information of 100,000 or more California consumers or households, or make half your revenue from selling or sharing personal information. Sharing data with an advertising network counts as sharing.
- ✓Who it covers: residents of California.
- ✓In force since 1 January 2020, with the CPRA amendments from 1 January 2023.
- ✓Exposure if you ignore it: Up to $7,988 per intentional violation, and per affected consumer, assessed by the California Privacy Protection Agency.
What CCPA / CPRA asks a product to do
Four obligations carry most of the weight for a digital product. They are what the clause set below is written against, and what the scan is looking for evidence of.
- ✓Publish a notice at collection describing every category of personal information you collect and what you do with each one — a paragraph of prose does not satisfy this; it is a categorised list.
- ✓Offer a Do Not Sell or Share link if any advertising or analytics vendor receives personal information for cross-context behavioural advertising, which most pixels do.
- ✓Honour the Global Privacy Control signal automatically. California treats an opt-out preference signal as a valid request, so ignoring it is a violation whether or not anyone clicked anything.
- ✓Give a way to limit the use of sensitive personal information — precise location, government identifiers, contents of messages — where you collect any.
What Poliogo puts in your documents
Poliogo carries a clause set written against CCPA / CPRA specifically. Every heading in the list below is a section the generator really writes, drawn from a library built from published regulatory text. Your stack is identified by pattern matching, not by a model, and the CCPA / CPRA sections are appended from the library whether or not any AI is reachable. An AI model is used for one thing: drafting extra clauses from operational notes you type yourself.
- ✓Do Not Sell Or Share My Personal Information — appended automatically when your stack and jurisdiction call for it.
- ✓Notice At Collection For California Residents — appended automatically when your stack and jurisdiction call for it.
- ✓Limit The Use Of Sensitive Personal Information — appended automatically when your stack and jurisdiction call for it.
- ✓Additional US State Privacy Rights — appended automatically when your stack and jurisdiction call for it.
- ✓US Opt-Out Preference Signals — appended automatically when your stack and jurisdiction call for it.
- ✓Global Retention Baseline — appended automatically when your stack and jurisdiction call for it.
- ✓Security Safeguards And Breach Notification — appended automatically when your stack and jurisdiction call for it.
Why a generated CCPA / CPRA policy beats a template
A template describes a product someone imagined. This one describes yours, and notices when yours changes.
Written from evidence, not recall
No SDKManifests first, then a vendor-endpoint sweep over the source. A raw fetch to a payment or model API with no SDK installed — the normal shape of AI-generated code — is still detected.
The statutory sections are fixed text
The CCPA / CPRA sections come from a pre-drafted library and are appended from it, not written by a model. Your stack is identified by pattern matching, so a model outage cannot remove a mandatory section. An AI model drafts only the extra clauses you ask for from your own operational notes.
You can explain every paragraph
Beside each clause sits a plain-English note: what it means, and which detected service made it necessary. You will not publish a sentence you could not defend to a customer.
It stays true after launch
DriftEach scan is diffed against the snapshot your documents were generated from. Adding a tracker on a Tuesday produces a pull request, not a quiet inaccuracy discovered during an audit.
The law moves too
A curated bulletin written against the statutes, filtered to the changes your own stack makes relevant — not a news feed. Included from Starter.
One product, several regimes
Most products serve more than one jurisdiction. The regional clause sets stack rather than compete, so a policy can satisfy the GDPR, CCPA and Israeli law at once without three documents.
How it works
A Git repository, a hosting account, or the repository your no-code builder syncs to. Source is read in flight rather than stored, and nothing in it changes except through a pull request you approve.
Every service your code calls, in plain English, with the evidence for each. This is what decides which CCPA / CPRA disclosures your documents need — a product with no advertising pixel should not carry an advertising disclosure.
Privacy policy, cookie policy and — from Starter — terms of service, with the CCPA / CPRA sections appended from the clause library. Those sections are fixed text, not written by a model.
Re-scan whenever you like on any plan, or let a paid plan watch in the background. A stack change becomes a pull request with a plain-English diff, and merging it is the approval.
Questions people ask
Does CCPA / CPRA apply to me?
You do business in California and either gross over $25 million a year, handle the personal information of 100,000 or more California consumers or households, or make half your revenue from selling or sharing personal information. Sharing data with an advertising network counts as sharing. If you are unsure, the honest answer is that most products serving residents of California are in scope, and the cost of assuming otherwise is up to $7,988 per intentional violation, and per affected consumer, assessed by the california privacy protection agency.
What does Poliogo actually write for CCPA / CPRA?
Poliogo carries a clause set written against CCPA / CPRA specifically. Every heading in the list below is a section the generator really writes, drawn from a library built from published regulatory text. Your stack is identified by pattern matching, not by a model, and the CCPA / CPRA sections are appended from the library whether or not any AI is reachable. An AI model is used for one thing: drafting extra clauses from operational notes you type yourself.
Is a generated policy good enough, or do I need a lawyer?
For routine day-to-day compliance — a privacy policy that matches your product, a working consent banner, and keeping both current as the product changes — this does the heavy lifting from clause logic built from published regulatory text. It does not replace counsel for a regulatory dispute, a corporate transaction or anything unusual about your situation. Poliogo is a compliance management technology platform, not a law firm, and this page is not legal advice.
How does it know what my product does with data?
It reads the project. Dependency manifests first, then a sweep of the source for known vendor endpoints — the URLs your fetch, axios and httpx calls address — so a raw HTTP call to a payment or model API is detected even with no SDK installed. Environment variable names are read as evidence; their values never are.
What happens when the law changes?
Regulation monitoring is a curated bulletin written against the statutes themselves, not a news crawler, and it is filtered to the changes your own stack makes relevant. It is included from Starter. When a change affects you, the update arrives with a plain-English explanation of what it asks for.
Can I see the CCPA / CPRA sections before I commit to anything?
Yes. Connect a project on the Free plan, run the scan and generate the documents — the full text, with the plain-English explanation beside every clause saying what it means and which detected service made it necessary. Nothing is published until you approve it, and no card is asked for.
Generate your CCPA / CPRA documents
Connect a project and see the detected stack in under 60 seconds. Free plan, no credit card, and nothing is published until you approve it. Poliogo is a compliance management technology platform, not a law firm, and this page is not legal advice.
Start free — no credit cardPoliogo is an automated code analysis and document display tool, not a law firm. Poliogo does not provide legal advice, representation, or guarantees of statutory compliance, ADA/WCAG certification, or legal immunity. Visual banners and generated documents are advisory tools and do not substitute for professional legal review.