The regulations implementing the CCPA make clear that the notice at collection (or the privacy notice if it is being used to satisfy the notice at collection) does not have to be physically provided to a consumer; instead a business must make it “readily available” in a location where consumers are likely to encounter it.¹ In the context of information that is collected over the telephone, a business “may provide the notice [at collection] orally.”² The Office of the Attorney General has clarified, however, that providing an oral notice is not necessarily the only method of compliance and that “[d]irecting a consumer over the phone to a place in which the notice can be found online is not prohibited by the regulation” such that the sufficiency of the practice would depend upon “a fact-specific determination.”³

¹ CCPA Reg. 999.305(a)(3).

² CCPA Reg. 999.305(a)(3)(d).

³ Final Statement of Reasons Appendix C at 11 (Response 36).