California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and Related Regulations -

1798.100 General Duties of Businesses that Collect Personal Information -

(a) A business that controls the collection of collects a consumer’s personal information shall, at or before the point of collection, inform consumers as to the of the following:

(1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used shall be used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section.