What must a California client site post, and who answers for it?

Who has to post the privacy policy on a client's site?

The site's owner has to post it. The law calls the owner the "operator", and says the operator "shall conspicuously post its privacy policy on its Web site". The operator, the law says, "does not include any third party that operates, hosts, or manages, but does not own, a Web site or online service on the owner’s behalf".

• So when your agency or a partner builds and hosts the site, the duty to post sits with your client, the owner.
• Personal details include a first and last name, an email address and a phone number, so a contact form that asks for a name and an email collects them.
• The rule protects people who buy for personal, family or household use, so it bites on client sites that sell to the public.
• The law also gives a grace period: an operator breaks the rule "only if the operator fails to post its policy within 30 days after being notified of noncompliance."

What does the privacy policy have to say?

The policy has to cover six things the law lists.

1. The kinds of personal details the site collects, and who they're shared with.
2. How a visitor can ask for changes to their details, when the site offers that.
3. How the site tells visitors about changes to the policy.
4. The date the policy takes effect.
5. How the site responds to "do not track" signals from a browser.
6. Whether other parties may collect personal details about visitors across sites.

When does a helper behind your brand have to be named?

California's privacy law has a rule for a "service provider", one that applies when your client is a business the law covers. A service provider, in the law's words, "means a person that processes personal information on behalf of a business" under a written contract.

• When a service provider brings in another person to help with that data, "it shall notify the business of that engagement", and that helper has to be bound by a written contract with the same limits.
• So in the case the law covers, the service provider has to tell your client's business about the helper working behind your brand.
• The law covers a for-profit business in California that meets one of three tests: yearly revenue of $26.625 million or more (the figure in force from January 1, 2025), buying, selling or sharing the data of 100,000 or more people or households, or half or more of its revenue from selling or sharing that data.
• The revenue figure can change each January.
• Whether your agency is a service provider for a client, and whether a builder's maker counts as a helper, depends on your own case. A lawyer can tell you how it fits the tools and partners you use.

Is website work taxed in California?

California's sales tax rule for advertising agencies treats designing, editing or hosting a website as a service when no physical goods change hands. In the rule's words, the charge for that service "is not subject to tax."

• A second rule covers ready-made software. When it's sent over the internet, with no disc or other physical copy, its sale "is not a taxable transaction".
• Neither rule names a monthly builder plan, a firm's monthly plan or a flat-rate team plan. Ask your accountant how they apply to what you buy and sell.

Who owns a site someone else builds?

Who owns a site that someone else builds turns on the contract, so put the site, its code, the domain and the logins in writing with any build partner.

• Under federal copyright law, a "work made for hire" is work an employee makes as part of the job, or a specially ordered work in one of nine listed kinds when both sides sign a written deal saying so. The nine kinds don't name a website, so ask a lawyer how a site is classed.
• For work made for hire, the copyright first belongs to the employer or the party that ordered it, unless it signed a deal saying otherwise.
• California adds its own rule. Its workers' comp law counts as an employee "Any person while engaged by contract for the creation of a specially ordered or commissioned work of authorship" when a signed deal calls it a work made for hire.
• Its unemployment insurance code then says "The ordering or commissioning party shall be the employer of the author of the work for the purposes of this part."
• California's Labor Code says "person" means "any person, association, organization, partnership, business trust, limited liability company, or corporation." Ask a lawyer before you sign a work made for hire clause with anyone.
• With a builder, the makers' terms say the content is yours and the platform stays theirs.

Does California's worker test matter for a site builder?

California's worker test matters when you'd hire one contractor to build sites. Under California's test, a worker counts as an employee unless the hiring firm can show three things. The worker isn't under its control, works outside its usual line of business, and runs an independent business doing that kind of work.

• A real business-to-business contract can sit outside that test when the hiring business can prove each of the 12 items the law lists.
• Item 2 matters for white label work, since the work is done for your clients. The provider has to serve your business directly, "rather than to customers of the contracting business", unless its own staff do the work under its own name and it regularly contracts with other businesses.
• Whether any firm meets the list is a question for a lawyer.

Do the top search results cover these rules?

We read the 3 top search results on October 14, 2026, and not one gave a California fact. In our sample of 5 neutral AI answers, taken that day from a browser in Arizona, none gave one either.

Nothing on this site is legal or tax advice.