Terms of Service Generator for CCPA-Covered Businesses
Enter your URL. We'll find the services collecting visitor data and generate the documents that disclose them.
Free scan and score. Privacy Policy, Terms and Cookie Policy for $19 one-time.
The California Consumer Privacy Act, as amended by the CPRA, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above the inflation-adjusted $25 million figure, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving half or more of revenue from selling or sharing personal information. Businesses that qualify must publish a privacy policy describing the categories of personal information collected in the preceding twelve months, the sources, the business purposes, the categories of third parties it is disclosed to, and whether it is sold or shared.
The policy must also explain the rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, along with how to exercise them and a non-discrimination statement. Businesses that share data for cross-context behavioral advertising must post a Do Not Sell or Share My Personal Information link, and a notice at collection must appear where data is gathered.
Meta Pixel, Google Ads, TikTok Pixel and LinkedIn Insight Tag are the services regulators most often treat as sharing. VerifiedPrivacy scans your site for them, generates a Privacy Policy with CCPA sections gated on your answers about California visitors and data sales, and flags when a Do Not Sell or Share link was not found on the page. Enter your URL below for a free scan.
Frequently asked questions
Does the CCPA apply to my small business?
Only if you meet one of the thresholds: roughly $25 million in annual revenue (adjusted for inflation), personal information of 100,000 or more California consumers or households, or half of revenue from selling or sharing data. Many small businesses fall below all three. California's separate CalOPPA law, however, applies to any commercial site collecting personal information from residents, so a privacy policy is still expected. Confirm your status with counsel.
What is the difference between selling and sharing personal information?
Selling means disclosing personal information to a third party for money or other valuable consideration. Sharing, added by the CPRA, means disclosing it for cross-context behavioral advertising whether or not money changes hands. Loading Meta Pixel or Google Ads remarketing tags is widely treated as sharing. Both trigger the opt-out right and the Do Not Sell or Share link requirement. The questionnaire asks about this directly.
Does the generated policy include a Do Not Sell or Share section?
When you indicate California visitors and that you sell or share data for advertising, the Privacy Policy includes a California section describing categories collected, purposes, third parties, the consumer rights and how to submit requests, plus a Do Not Sell or Share statement. The link itself and the mechanism that actually stops the pixels are things you add to your site; the coverage score warns when the link is not found.
Do I need to honor Global Privacy Control signals?
Under the CPRA regulations, businesses that sell or share personal information must treat an opt-out preference signal such as Global Privacy Control as a valid request to opt out, and California's Attorney General has enforced this. Honoring GPC is a technical implementation in your consent tool or tag manager. The generated Privacy Policy includes a statement about opt-out preference signals in the California section for you to confirm.
Does the scan check for a Do Not Sell or Share link?
Yes. When you indicate California visitors and data sharing, the scoring looks for a Do Not Sell or Share link pattern on your homepage and reduces the coverage score with a warning if none is found. It does not verify that the link works or that clicking it actually stops data flows, which requires testing in your consent tool. Free rescans from the verification page let you check after adding it.
Other guides
VerifiedPrivacy generates documents from a clause library. It is not a law firm and does not provide legal advice. Have a licensed attorney review documents before use.