Business Obligation - Notice and Transparency
All five states require a privacy notice and a notice of the right to opt out. Only California requires notice at the point of collection, and California alone mandates specific website links: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Personal Information."
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US exam questions.
All five states require a privacy notice with similar core elements: categories of data, purpose of processing each category, any sale and how to opt out, categories shared with third parties, and how to exercise rights. California adds elements like retention duration per category and categories of sensitive data.
| Obligation | States |
|---|---|
| Privacy notice | All five |
| Notice of right to opt out + conspicuous opt-out method | All five |
| Notice at point of collection | California only |
| "Do Not Sell or Share My Personal Information" link | California (sell/share businesses) |
| "Limit the Use of My Personal Information" link | California (sensitive-data businesses) |
Only California requires notice at the point of collection. California is also the only state mandating the "Do Not Sell or Share My Personal Information" link and the "Limit the Use of My Personal Information" link.
Key terms - quick answers
What is “Privacy notice”?
What is “Notice at point of collection”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.