---
path: /legal/ccpa
surface: customer
domain: onboarding-public
auth: anon
source: apps/oshun/web/src/app/legal/ccpa/page.tsx
status: walked
last_walked:
  '2026-05-29 automated runtime walk (Playwright headless) — render, /v1 data
  (2xx), console/page-errors, expected content, screenshot verified; manual
  screen-reader and real telemetry-delivery checks pending. Evidence:
  WALKTHROUGH/results/runtime-sweep-2026-05-29.md; 2026-06-28 public-legal-pages
  Playwright pass covered anonymous routing, exact section inventory, legal nav
  matrix/active states, TOC/back-to-top/print shell controls, 390 px
  no-overflow, 44 px touch targets, offline-after-load stability, no telemetry
  hooks, and axe. Manual AT pass and real telemetry delivery remain pending.'
---

# Legal · CCPA Notice

## Purpose

California Consumer Privacy Act / CPRA notice for California residents. Seven
sections rendered through `LegalPageShell`. Supplements the main Privacy Policy.

## Entry points

- Footer link "CCPA" on `/welcome` and `/landing`
- Sidebar nav from other `/legal/*` pages
- Cross-reference from `/legal/privacy` body copy
- Direct URL / bookmark — yes (anon)

## Layout regions

`page.tsx` defines `SECTIONS`: `scope`, `categories`, `rights`, `sale-sharing`,
`retention`, `exercise-rights`, `contact`.

- **Header (shell)**: minimal brand + back link
- **Sticky sidebar**: cross-legal nav + 7-entry TOC
- **Main article**: h1 "California Consumer Privacy Act (CCPA) Notice",
  `data-legal-date` "Last updated: February 21, 2026", seven sections:
  - Scope
  - Categories Collected (identifiers, internet activity, geolocation,
    inferences)
  - Your Rights (six bullets: know, delete, correct, opt-out of sale/sharing,
    non-discrimination, limit sensitive info)
  - Sale & Sharing — declares "OSHUN does not sell"
  - Retention (90-day analytics window)
  - Exercise Rights — references `privacy@oshun.app` with "CCPA Request" subject
    and the in-profile data tools
  - Contact: `privacy@oshun.app`
- **Floating control**: back-to-top button

## States

- [x] **Loading** — N/A; static
- [x] **Default** — all seven sections render
- [x] **TOC click / active section** — clicking a TOC button scrolls to that
      section and marks it `data-active="true"`; passive scroll-spy remains
      `IntersectionObserver`-driven
- [x] **Back-to-top visible** — the shared 44 px control appears after scrolling
      and returns the user near the document start
- [x] **Narrow viewport (≤ 768px)** — sidebar collapses and avoids horizontal
      overflow at 390 px
- [x] **Print** — chrome stripped, hrefs appended after links
- [x] **Offline after load** — once loaded, the URL, heading, section inventory,
      and active legal nav state remain stable when the browser context goes
      offline
- [x] **Gated** — N/A; anonymous-readable

## Interactions

### Cross-legal sidebar nav

- [x] **Each `LEGAL_NAV` link** — sibling legal page navigation, active state,
      and at least 44 px mobile target

### On-this-page TOC

- [x] **Each TOC button** (7) — `scrollIntoView` to that section and immediate
      active state after click

### Back-to-top

- [x] **"↑"** — smooth-scroll to top when visible

### Body content

References "data management tools in your profile settings" as plain text (no
link to `/profile`). Email `privacy@oshun.app` is plain text, not mailto. Verify
intent.

## Data & contracts

- **Reads**: none — static text
- **Writes**: none
- **Caching**: SSR static; loaded-route offline stability is asserted. Cold
  offline navigation / per-legal SW path caching is not asserted, and current
  `sw.js` does not path-cache `/legal/*`.
- **Auth**: anon (in middleware `PUBLIC_PREFIXES`)
- **Metadata**: `title: 'CCPA Notice'`,
  `description: 'California Consumer Privacy Act notice for OSHUN users.'`

## Cross-references

- Profile data tools (referenced in body): linked from
  [`../09-account/profile.md`](../09-account/profile.md)
- Sibling legal pages: [`legal-privacy.md`](./legal-privacy.md),
  [`legal-terms.md`](./legal-terms.md),
  [`legal-cookies.md`](./legal-cookies.md),
  [`legal-accessibility.md`](./legal-accessibility.md),
  [`legal-dpa.md`](./legal-dpa.md)
- Component sources:
  - `apps/oshun/web/src/components/legal/LegalPageShell.tsx`

## E2E coverage

- Backed by
  [`apps/oshun/web/e2e/public-legal-pages.spec.ts`](../../../apps/oshun/web/e2e/public-legal-pages.spec.ts)
  — covers anonymous access, exact seven-section inventory, legal nav
  inventory/active state, shared TOC/back-to-top/print shell behavior, 390 px
  no-overflow, 44 px touch targets, offline-after-load stability, no telemetry
  hooks, and axe.

## Open questions / known gaps

- [ ] Cold offline navigation / per-legal SW cache is not asserted and current
      `sw.js` does not path-cache `/legal/*`; PWA shell cache coverage remains
      in the offline-first / PWA walkthroughs.
- [ ] "Data management tools" reference should likely deep-link to `/profile`
      settings — confirm
- [ ] `privacy@oshun.app` not mailto-linked; confirm intent
- [ ] No automated CCPA request webform; users must email — confirm whether a
      request flow lives in `/profile`
- [ ] 45-day response window stated; verify operational SLA