Almost certainly yes. If your website asks a visitor for a name, a phone number, or an address, through a contact form or a chat window, California’s online privacy law tells you to post a privacy policy, and that law has no revenue floor and no employee count anywhere in it. The much bigger law people worry about, the CCPA, has thresholds a local trade shop is very unlikely to hit.
The law with no size limit
The document to read is California Business and Professions Code section 22575. It was amended by Stats. 2013, Ch. 390, Sec. 1 (AB 370), effective January 1, 2014.
It applies to “an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service.”
Read that line for what it does not say. It does not say how much you earn. It does not say how many trucks you run, or how many people visit your site in a month. Commercial site, collects personal information, some of those people live in California. That is the whole test, and nothing in sections 22575 through 22579 lets you out on size.
This is not legal advice, and it was not written by an attorney. Before you act on any of it, take it to your own attorney or to your state attorney general’s office.
Why a form or a chat window counts as collecting
Section 22577 is the definitions half of the same law. It was added by Stats. 2003, Ch. 829, Sec. 3, effective January 1, 2004, and the section became operative July 1, 2004.
It defines personally identifiable information as individually identifiable information about a consumer collected online by the operator from that individual and maintained by the operator “in an accessible form.” The examples it gives include a first and last name, a home or physical address, an email address, and a telephone number.
Now think about what your site asks a stranger at nine at night. Name. Phone. The address of the job. Often an email. Then the form or the transcript lands in an inbox or a dashboard where you can go back and read it. That is collected, and it is accessible.
One line in 22577 is worth pinning to the wall. The definition of operator “does not include any third party that operates, hosts, or manages, but does not own, a Web site or online service on the owner’s behalf or by processing information on behalf of the owner.” The company selling you the form or the chat is not the operator. You are. This duty does not pass to the vendor.
The big law you are probably not under
People hear California and privacy in one sentence and think of the CCPA. That is a different statute with a different door.
California Civil Code section 1798.140, subdivision (d), sets out who counts as a “business” under it. The version on the books was amended by Stats. 2025, Ch. 67, Sec. 27 (AB 1170), effective January 1, 2026. Paragraph (d)(1) gives three tests, and you have to meet at least one:
- Annual gross revenues in excess of $25,000,000 in the preceding calendar year, as adjusted for inflation.
- Buying, selling, or sharing the personal information of 100,000 or more consumers or households in a year.
- Getting 50 percent or more of your annual revenues from selling or sharing personal information.
That first figure moves. Civil Code section 1798.199.95, subdivision (d), tells the California Privacy Protection Agency to adjust it on January 1, 2025, and on January 1 of every odd numbered year after that. The agency’s page on updated monetary thresholds, posted December 17, 2024, put the figure at $26,625,000 effective January 1, 2025. The next adjustment is due January 1, 2027.
A four truck HVAC shop clears none of those three. So the CCPA machinery, the rights requests and the deletion process, most likely never switches on for you. The posting duty in 22575 still does. Two laws, two very different bars, and the small one is the one that reaches you.
Here is the limit on all of that. Those are the thresholds in the text as it reads today. Statute text gives you the rule. It does not tell you how a regulator would look at your particular shop, which is again a question for an attorney.
What the policy actually has to say
Section 22575(b) runs to seven paragraphs. Six of them are things your policy has to do. In plain terms:
- Name the categories of personal information you collect, and the categories of outside companies you share it with.
- Say how a person can review and ask you to change what you hold, if you offer that.
- Say how you will tell people the policy has changed.
- Carry the date it took effect.
- Say how you respond to a browser’s do not track signal, if you do that kind of tracking.
- Say whether anyone else is collecting information about your visitor across other sites while they are on yours.
The seventh is a shortcut rather than a duty. It lets you meet the do not track item with a clear link to a page describing whatever program you follow.
California is not alone in this. Delaware’s law, 6 Del. C. section 1205C, carries the citation 80 Del. Laws, c. 148. That page carries no update date. It asks an operator to make its privacy policy “conspicuously available,” it has no revenue test either, and section 1203C hands enforcement to the Consumer Protection Unit of the Department of Justice.
Nevada is narrower than it first looks. NRS 603A.340 lists five items a notice has to carry, and NRS 603A.330 excludes third parties who host a site for somebody else, the same way California does. But 603A.340 does not apply to an operator that is located in Nevada, earns its revenue mainly from something other than selling on a website, and gets fewer than 20,000 unique visitors a year. That is a lot of local shops. The Nevada legislature’s chapter page carries a revision stamp of April 15, 2026.
Three states, three different answers, and yours may be a fourth. This is not legal advice. Ask an attorney licensed in your own state, and read what your own state attorney general publishes, before you decide you are clear.
Here is a number you can go check yourself in both the California and the Delaware text: 30 days. Both say an operator is in violation only after failing to post within 30 days of being told it is not compliant. That is a chance to fix it, not permission to skip it.
What this will not do for you
A privacy policy describes what your site does. It does not change what your site does. If your agent keeps transcripts for two years in a place three other companies can read, writing that down honestly does not make it a good idea.
Do not buy a generated policy that lists categories you do not collect. A policy that does not match your own site is a written record of something untrue, which is worse than the blank page you started from.
Nobody at Galloping writes privacy policies, and none of the plans include one. The site build, the search work, and the on site agent are what the three monthly plans cover. The policy is your attorney’s job, or a call to your state bar’s small business referral line.
What to do this week
- Open your own contact form and your own chat and use them like a customer with a burst pipe. Write down every single thing they ask you for. There is a fuller run through in testing your agent before you turn it on.
- Email the vendors behind your form and your chat and ask three things in writing: where the records are stored, how long they are kept, and which other companies can see them.
- Take that list and those answers to an attorney, and have a policy written that matches them.
- Link it in your footer, and link it again right next to the form and the chat window, where a person is about to type their phone number.
- Put an effective date on it, and change that date whenever you change the policy.
If you want to know what an on site agent should be asking for in the first place, and what it should hand straight to a human, that is set out on the AI assistant page. The recording and wiretap side of a chat widget is a separate question with its own answer in is a chat widget a privacy problem.