What you need in your privacy policy that’s new for CCPA is an explanation of the four core consumer CCPA rights and how to access them:
First is the right to know about the information your business collects, discloses and sells.
The right to know includes the consumer’s right to receive general disclosures in your privacy policy about the categories of data your business collected and disclosed or sold in the last 12 months, the categories of sources from which you collected it, the categories of third parties it was sold or disclosed to and the business purpose for collecting or selling it.
For example, your privacy policy might disclose that you collect browsing analytics data from the consumers’ web browsers and email addresses when consumers volunteer them, and that you sell browsing analytics data to an ad targeting platform for the purpose of delivering more relevant ads and that you merely disclose email addresses to your email service provider for use on your behalf for the purpose of delivering email campaigns to consumers.
The right to know also includes a consumer’s right to receive individualized disclosure about the categories information you collected disclosed or sold about them, plus the right obtain to a copy of the actual information you collected about them. Your policy should also inform consumers about these individualized rights.