1798.100(a)-(b) — Notice at collection

high privacy-noticedata-retention

Requirement

At or before the point of collection, the business informs consumers of the categories of personal information (and sensitive personal information) collected, the purposes for which each is collected or used, whether it is sold or shared, and how long each category will be retained — and does not collect additional categories or use them for incompatible purposes without notice.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

notice at collectionat or before the point of collectionat the point of collectionprivacy noticeprivacy policywhen we collect

Required element 2 — any one of

categoriescategory

Required element 3 — any one of

purposespurposesold or sharedsell or shareretention periodhow longretain…

Supporting terms — specificity signals

1798.100regs 7012sensitive personal informationlinkonline form

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.5(1)(a)	Lawfulness, fairness and transparency	privacy-notice
GDPR	Art.5(1)(e)	Storage limitation	data-retention
GDPR	Art.12	Transparent communication and handling of rights requests	privacy-notice
GDPR	Art.13	Information when data is collected from the data subject	privacy-notice
GDPR	Art.14	Information when data is not obtained from the data subject	privacy-notice
SOC 2	CC2.3	External communication	privacy-notice
SOC 2	C1.2	Disposal of confidential information	data-retention
SOC 2	P1.1	Notice and communication of privacy commitments	privacy-notice