Legal outline

Privacy notice content plan.

The final privacy notice must match the actual vendors, systems, data flows, cookies, marketing tools, retention practices, and rights process.

Counsel and vendor review required: Do not publish a generic policy that does not match the actual business.

Entity and privacy contact

Information collected directly

Information collected from records, banks, devices, cookies, and vendors

Purposes of collection and use

Service providers and financing partners receiving data

Credit and fraud review

Marketing communications and opt-outs

Cookies and analytics

Retention and security practices

State privacy rights

Policy changes and effective date