Notice at collection: what visitors are told at sign-up

The rule

The CCPA asks for the notice at the moment of collection. The privacy policy is a separate, fuller document. A visitor about to type an email address or a delivery address should be told what is being taken before it is taken.

Subdivision (b) is the separate rule for a business that controls collection “acting as a third party”; this article relies on subdivision (a).

The regulations say how the notice must be given.

Section 7003 adds that the notice must use plain language, be readable on smaller screens and be reasonably accessible to people with disabilities. It also asks that a conspicuous link use a font size and colour at least approximately the same as the other links next to it on pages where information is collected.

Two situations catch businesses out: third-party tools and people who are not shoppers. Under §7012(g), more than one business may control collection, and where a first party lets an ad network collect information on its website, “both” must provide a notice at collection, though they may give a single combined notice. The CPPA’s Tractor Supply decision of 30 September 2025 is described by the agency as “the first to address the importance of CCPA privacy notices and privacy rights of job applicants.”

Who counts as a “business” is set out in US-04. Penalties are the same as for the rest of the CCPA. Section 1798.155 caps a fine at “$2,500 for each violation”, or $7,500 for intentional ones and those involving minors, adjusted for inflation to $2,663 and $7,988 on the CPPA’s page.

What PeekWell checks and how

US-05 asks whether a visitor is told what is collected, and why, at the place where they hand it over. The check applies when a site’s markets include California. Detection is AI-assisted: code finds the forms and checks for a notice, and a language model helps judge what a notice says.

The scan opens public pages in a fresh browser and looks for data-entry points: newsletter boxes, contact forms, account sign-up and checkout fields that are visible without signing in. For each form it checks by a presence test whether a notice is linked or embedded. Where one is found, a language model reads it and checks whether it describes categories and purposes. The report notes which forms had a notice and which had none.

The scan never types into a field and never submits a form. It reads what is there. It does not decide which of your forms count as collection that the CCPA covers, and it does not know whether the categories you list match what your systems actually take.

The limits are those of a visit from outside. The scan sees public pages and not anything behind a sign-in, so a collection point inside an account or an app is outside what a browser visit can see. Collection by phone, in a shop or on a paper form is out of reach too. It cannot confirm that the retention periods in a notice are the ones you apply. A Passed means a notice was found. It does not say the notice is complete or that the business complies. Whether the policy itself is adequate is the subject of US-13, and the comparison of ad tools with the policy is in US-04.

Why it matters for a company

Few published decisions turn on a notice at collection alone. The California Attorney General’s enforcement examples page says the office “does not generally release information to the public about its investigations,” and describes cases without naming companies. At least three of its examples are about this duty. An automotive business collected information from people who test drove vehicles without giving a notice at collection, and then added one for information gathered online or in person. A financial services app for minors did not tell consumers the categories collected, and responded by adding a link to its notice on the first screen of the app. A telehealth portal’s link to its notice sent consumers to the start of its privacy policy instead of the relevant section, and the company fixed it by linking directly to that section. That last one is the standard in §7012(f).

The named decision is Tractor Supply. The CPPA said the retailer, which it described as having more than 2,500 stores in 49 states, did not keep a privacy policy that notified consumers of their rights and did not notify California job applicants of their privacy rights and how to use them, along with an opt-out mechanism that did not work and missing contracts. It agreed to pay $1,350,000, which the CPPA described as its largest fine.

For a company the points are practical. A notice is judged where the visitor is, so a good privacy policy elsewhere does not make up for a form with nothing near it. A link to the wrong part of a long policy does not meet the standard. And the duty reaches every group whose information you collect, which is why applicants and app users appear in the examples.

Smaller companies and larger companies

The duty has no separate form for small sites. Any business covered by the CCPA owes the notice, and a small business that falls inside the thresholds in US-04 owes it on every form it runs.

In a small company the forms come from a website builder, a newsletter tool and a booking plugin, each with its own embedded sign-up. The policy was written once by a generator. Nobody put a link beside the fields, and a footer link to the policy is taken to be enough. The Attorney General’s anonymised examples describe businesses fixing notice gaps after a warning, though the page does not say how large they are.

In a larger company the collection points are many: hiring portals, loyalty sign-ups, store tablets, mobile apps and landing pages built by agencies. Each team owns its own form and none owns the notice. Tractor Supply’s case shows how a policy that exists can still miss a group, here job applicants.

How to fix it

The work is to give each place that collects information its own short notice, and make the link land in the right place.

1. List every collection point. Walk through your public pages and write down each form, popup, chat widget and sign-up box. Include careers pages and any form that a plugin or agency added. For each one, note what it collects.
2. Write one notice at collection. In plain language, list the categories of personal information, the purpose for each, whether each is sold or shared, and how long it is kept. If you collect sensitive information, say so separately. Add a link to your privacy policy and, if you sell or share, to your opt-out page.
3. Put it next to the fields. Place a conspicuous link close to the inputs or the submit button on every form, and on pages where information is collected. Check it on a phone, where small grey text is easy to miss.
4. Deep-link into the policy if you use it. If the link points to the privacy policy, send it to the section that holds the required information, with an anchor. Do not send visitors to the top of the page.
5. Cover third-party tools. For each ad network, analytics tool or widget that collects through your pages, make sure its collection is described in your notice. Under §7012(g) you and the vendor may give one joint notice.
6. Add the other groups. Job applicants, app users and anyone else you collect from need a notice at their own point of collection. Write one for each.
7. Re-scan. Run a scan after the changes. The finding should clear once each form has a linked or embedded notice that describes what it collects.