California website privacy: a practical starting point.

Draw a simple map of what happens

For each form or embedded service, record what information is entered, where it is sent, who can access it, why it is needed, and how long it is retained under your actual process. Include spreadsheets and inboxes, not only the main website platform. A general inquiry may pass through a hosting service, email provider, and staff account before anyone replies.

For example, a Bay Area studio may use one provider for bookings and another for newsletters. A dental practice may link to a separate reviewed patient portal while keeping the general website form limited to ordinary inquiries. The point is to describe the actual workflow rather than assume every outside tool has the same settings or responsibilities.

Distinguish a privacy notice from a compliance decision

The California Attorney General explains that CalOPPA requires covered commercial websites collecting personally identifiable information about California consumers to conspicuously post a privacy policy. That question is separate from whether the business falls within the CCPA. Do not assume that being small answers every website privacy question.

The California Privacy Protection Agency describes CCPA coverage using business criteria and thresholds, with additional situations and obligations. Assess your actual activities and relationships using current guidance and appropriate advice. A generic banner saying that the site is compliant is not a substitute for this review.

References: California Attorney General [1]California Privacy Protection Agency [2]

Review tracking before adding more of it

List analytics, advertising pixels, chat widgets, embedded media, and other code that communicates with outside providers. Ask why each tool is needed and whether its settings match the business’s decisions and notice. Remove tools that nobody uses instead of inheriting a long stack of trackers from an old template.

Whether particular consent, opt-out, or other controls are required depends on the applicable law and the data practices. Do not assume every California website needs the same cookie banner or that installing one makes all tracking appropriate. Have the implementation reviewed against the actual requirements, including relevant provider arrangements and customer choices.

References: California Privacy Protection Agency [2]

Keep general forms away from sensitive records

Ask only for what is needed to respond to the request. A general website form usually does not need payment-card data, medical histories, account passwords, or detailed financial records. Direct such information to an appropriate system and agreed process when the service genuinely requires it.

Place clear instructions next to a message field where people may otherwise paste sensitive details. Decide who receives submissions and how they are removed when no longer needed under your retention policy. If you add uploads, chat, or an AI assistant, repeat the review; each new input channel can change the information the business handles.

Make the notice match the experience

Use a notice that accurately describes the information collected, purposes, relevant sharing, contact process, and applicable rights. Coordinate it with the actual forms, signup wording, and service-provider settings. A notice that says information is never shared can conflict with a site that sends it to outside booking or marketing services.

Ask the legal or privacy reviewer what needs to change in both the wording and the implementation. A web developer can configure tools and publish approved text, but should not invent assurances about all legal obligations, data security, or a vendor’s behavior. Keep a record of the approved version and the date the site was reviewed.

References: California Attorney General [1]

Revisit the map when the business changes

Review privacy when you add a platform, turn on advertising, start a newsletter, connect a CRM, or change a form. Assign someone to receive privacy-related messages and route requests appropriately. Make sure a former staff member’s inbox is not the only place where those messages arrive.

The useful deliverable is a manageable record of data flows, approved notices, configured choices, and responsibilities. Keep the review specific to the business. If you need a legal assessment, get one before treating a template or a website launch as permission to collect additional information.