Notice at or before collection discloses categories and purposes

CCPA § 1798.100(b) requires notice at or before the point of collection — not buried in a privacy policy that users are expected to locate and read on their own. A signup form that collects email and name without any adjacent disclosure violates this requirement, even if a comprehensive privacy policy exists at /privacy. CPRA's addition of § 1798.121 extends this to sensitive PI: precise geolocation, financial account details, and health data each require a distinct notice at the collection point. Forms with no inline notice cannot satisfy this requirement retroactively by updating the privacy policy after the fact.

Add a brief inline notice below the submit button of every data-collection form — signup, checkout, contact, newsletter. The notice must be visible without scrolling; a single sentence plus a privacy policy link satisfies the requirement.

// Signup form — add notice directly below submit button
<form onSubmit={handleSubmit}>
  <label>Email <input type="email" required /></label>
  <label>Password <input type="password" required /></label>
  <button type="submit">Create Account</button>
  {/* Required by CCPA § 1798.100(b) */}
  <p className="text-xs text-muted-foreground mt-2">
    We collect your email to create and manage your account. We do not sell
    your personal information. <a href="/privacy">Privacy Policy</a>.
  </p>
</form>

For checkout forms that collect financial account details or precise billing address, the notice must specifically call out sensitive PI categories per CPRA § 1798.121. Audit every route under app/ that renders a <form> element and add notice where absent.