Do I need a cookie banner?
A banner exists to ask consent for cookies and trackers that need it, which the EU and UK require for non-essential ones. Tick analytics or advertising cookies and EU or UK visitors to see the rule that applies.
Which privacy rules reach your product
Say what your product does and collects, and get the public rules that may apply to it, each with what it requires and a link to its source. Current as of Oct 14, 2026. Clauseworthy is not a law firm and does not give legal advice.
- SourcesStatutes, regulations and regulators' pages
- PrivacyRuns in this tab; nothing is uploaded
- OutputA checklist PDF, no policy text
Checklist
Rules that may apply
Tick what you collect to see the list.
A list, not a policy.
Each item says what a rule requires of the businesses it covers, and why it is on your list.
What this does not do
- It does not write a privacy policy or terms; there is no licensed base to draft them from.
- It does not decide whether your business meets a threshold or complies with a rule.
- Laws outside the US, EU and UK, and sector rules such as HIPAA's details, are only named, not covered.
Sources
Every rule the checklist can list, and every threshold it quotes, with the public source it comes from. Checked as of Oct 14, 2026.
- Privacy policy posted on the site (CalOPPA)
California Business and Professions Code § 22575, as of Oct 14, 2026
- California Consumer Privacy Act (CCPA, as amended by the CPRA)
California Civil Code § 1798.140(d) — definition of "business", as of Oct 14, 2026
- Whether the CCPA reaches the business
California Privacy Protection Agency — Updated Monetary Thresholds in CCPA (effective January 1, 2025), as of Oct 14, 2026
- Other US state privacy laws
IAPP — US State Privacy Legislation Tracker, as of Oct 14, 2026
- EU General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679 (GDPR), EUR-Lex, as of Oct 14, 2026
- UK GDPR and the Data Protection Act 2018
ICO — UK GDPR guidance and resources, as of Oct 14, 2026
- Cookie consent in the EU (ePrivacy Directive)
Directive 2002/58/EC (ePrivacy Directive), EUR-Lex, as of Oct 14, 2026
- Cookies and similar technologies in the UK (PECR)
ICO — Guidance on the use of storage and access technologies: What are the exceptions?, as of Oct 14, 2026
- Children's Online Privacy Protection Act (COPPA)
FTC — Children's Online Privacy Protection Rule (16 CFR Part 312); amendments at 90 FR 16918, as of Oct 14, 2026
- Commercial email (CAN-SPAM Act)
FTC — CAN-SPAM Act: A Compliance Guide for Business, as of Oct 14, 2026
- Marketing email to people in the EU or UK
Directive 2002/58/EC (ePrivacy Directive), Article 13, EUR-Lex, as of Oct 14, 2026
- Card payments (PCI DSS, through the payment processor)
PCI Security Standards Council — Document Library, as of Oct 14, 2026
- Terms of service
Common Paper — standard agreements (CC BY 4.0), as of Oct 14, 2026
- Subscriptions that renew automatically (California)
California Business and Professions Code § 17602, as of Oct 14, 2026
- Designated agent for copyright notices (DMCA § 512)
US Copyright Office — DMCA Designated Agent Directory FAQ, as of Oct 14, 2026
- Accessibility (ADA Title III)
US Department of Justice — Guidance on Web Accessibility and the ADA, as of Oct 14, 2026
- European Accessibility Act (e-commerce to consumers)
Directive (EU) 2019/882 (European Accessibility Act), EUR-Lex, as of Oct 14, 2026
- Health data: HIPAA
US Department of Health and Human Services — Covered Entities and Business Associates, as of Oct 14, 2026
- Health data outside HIPAA: FTC Health Breach Notification Rule
FTC — Health Breach Notification Rule (16 CFR Part 318), as of Oct 14, 2026
- Consumer health data: Washington My Health My Data Act
Revised Code of Washington, chapter 19.373, as of Oct 14, 2026
- Annual gross revenue in the preceding calendar year above: $26,625,000 (CPI-adjusted every odd-numbered year; was $25,000,000)
California Privacy Protection Agency — Updated Monetary Thresholds in CCPA (effective January 1, 2025), as of Oct 14, 2026
- Annually buys, sells or shares the personal information of: 100,000 or more California consumers or households
California Civil Code § 1798.140(d) — definition of "business", as of Oct 14, 2026
- Share of annual revenue from selling or sharing personal information: 50% or more
California Civil Code § 1798.140(d) — definition of "business", as of Oct 14, 2026
- Typical resident-count threshold, per the IAPP tracker: 100,000 residents (varies by state)
IAPP — US State Privacy Legislation Tracker, as of Oct 14, 2026
- Age covered: under 13
16 CFR § 312.2, as of Oct 14, 2026
- Time to honour an opt-out: 10 business days
FTC — CAN-SPAM Act: A Compliance Guide for Business, as of Oct 14, 2026
- Fee per designation, amendment or resubmission: $6
US Copyright Office — DMCA Designated Agent Directory FAQ, as of Oct 14, 2026
- Designation expires after: 3 years unless renewed
US Copyright Office — DMCA Designated Agent Directory FAQ, as of Oct 14, 2026
- Microenterprise exemption for services: fewer than 10 employees and turnover or balance sheet ≤ €2 million
Directive (EU) 2019/882, Articles 3(23) and 4(5), as of Oct 14, 2026
Questions about the checklist
Does the CCPA apply to a small startup?
Only if the business meets at least one of its thresholds. Choose "Not sure" to see the three thresholds with their sources.