No.
A privacy policy typically discloses the following information to the public:
- The categories of information collected from a data subject directly and from third parties about a data subject,
- The purpose for which information is collected and used,
- The ability (if applicable) of a data subject to opt out of their information being sold,
- The extent to which the business tracks or monitors data subjects,
- The extent to which the business shares the data subject’s information with third parties,
- The standard by which the business protects the information from unauthorized access,
- The ability (if any) of a data subject to request access to their information,
- The ability (if any) of a data subject to request the deletion of their information,
- The ability (if any) of a data subject to request the rectification of inaccurate information, and
- The process by which a business will inform data subjects about changes in its privacy practices.
The CCPA, and the regulations implementing the CCPA, require that a business that collects consumer personal information disclose the first three categories of information “at or before the point of collection”; they do not require that all of the information typically contained in a privacy policy be disclosed at that time. As a result, if a business discloses the categories of information collected and the purpose of the collection to a consumer orally, contextually, or in a summary form, at or before the point of collection, and if the business does not sell personal information, the CCPA does not mandate that the entirety of the privacy policy be provided to the consumer.