What Is a Privacy Policy?
A privacy policy is a legal document on a website that explains what personal information the business collects, how it uses that data, who it shares the data with, and what rights visitors have over their information. It covers things like names, emails, payment details, cookies, and analytics. Privacy laws such as California's CCPA/CPRA and the EU's GDPR require most sites that collect any personal data to publish a clear, accurate privacy policy.
- Core function
- Disclose what personal data is collected, why, and how it is handled
- Who needs one
- Almost any site collecting names, emails, payments, or analytics data (CCPA/CPRA, GDPR)
- Required disclosures
- Data types, purposes, sharing, retention, and consumer rights (CPRA)
- Placement
- Linked in the site footer on every page (industry-standard practice)
What is a privacy policy and what does it do? #
A privacy policy is a public statement that tells visitors exactly how a website handles their personal information. Personal information covers far more than most owners realize: names and email addresses from contact forms, phone numbers, mailing addresses, payment card details, IP addresses, device information, and the identifiers that analytics and advertising cookies collect. The policy explains what data you gather, the reasons you gather it, whether you share or sell it, how long you keep it, and how visitors can access, correct, or delete it. It is both a legal requirement in many jurisdictions and a trust signal that reassures customers a business is handling their data responsibly. For a local service business, the policy is often the difference between a form submission that feels safe and one that feels risky. You can generate a solid starting draft at /tools/privacy-policy-generator and pair it with the consent tools described at /wiki/what-is-a-cookie-banner.
Which laws require a privacy policy? #
Multiple overlapping laws make privacy policies effectively mandatory for most websites. In California, the CCPA as amended by the CPRA requires businesses meeting certain thresholds to disclose data practices and honor consumer rights like access, deletion, and opting out of sale or sharing. Virginia, Colorado, Connecticut, Utah, Texas, and a growing list of states have their own comprehensive privacy laws with similar duties. The EU and UK GDPR apply to any site that processes the personal data of people in those regions, regardless of where the business is located. Sector rules add more: HIPAA for health information, COPPA for data from children under 13, and CAN-SPAM for email marketing. Even where a specific statute might not technically apply, browsers, app stores, ad networks, and payment processors often demand a policy before they let you operate. The safest approach for any US local business collecting data is to publish a clear, accurate policy. See how the laws fit together at /wiki/website-privacy-laws-explained.
What must a privacy policy actually include? #
A complete privacy policy answers a predictable set of questions. It identifies the business and how to contact its privacy team. It lists the categories of personal information collected, such as identifiers, contact details, payment data, and internet activity. It explains the purposes, for example fulfilling orders, responding to inquiries, sending marketing, or improving the site. It describes sources of data and the third parties you share it with, like payment processors, email platforms, hosting providers, and analytics or advertising services. It states retention periods or the criteria used to set them, and the security measures that protect the data. Crucially, it spells out the rights visitors have, how to exercise them, and how requests are verified and answered. Policies aimed at Californians must include specific CPRA disclosures, and those covering Europeans must address the legal bases for processing. A vague, copied policy that does not match your real practices is worse than none, because it can be treated as a deceptive statement.
What is the difference between a privacy policy and terms of service? #
These two documents are often linked together in a footer, but they serve different jobs. A privacy policy is about data: what information you collect from visitors and how you treat it. Terms of service, sometimes called terms and conditions or terms of use, are about the rules of using your website or service: acceptable use, intellectual property, payment and refund terms, disclaimers, limitation of liability, and dispute resolution. One protects the visitor's privacy interests; the other protects the business's legal and commercial interests. Many websites need both. A restaurant taking online orders, for instance, needs a privacy policy for the customer data it collects and terms of service that set out ordering, cancellation, and liability rules. Confusing the two, or trying to cram everything into one document, weakens both. You can read more about the companion document at /wiki/what-is-a-terms-of-service, and we routinely set up both when building a site through /services/web-design.
How do you write and maintain an accurate policy? #
The most important rule is accuracy: your policy must describe what your site actually does, not a generic template. Start by inventorying every place you collect data, including contact forms, newsletter sign-ups, e-commerce checkout, live chat, analytics, ad pixels, and embedded third-party widgets. Map where that data goes and which vendors process it. Then write in plain language that a regular customer can understand, avoiding dense legalese where possible. A generator such as /tools/privacy-policy-generator gives you a structured starting point, but you must customize it to your real tools and, for anything high-stakes, have it reviewed by a qualified attorney. Privacy policies are living documents. Every time you add a new tool, such as a chat widget, a retargeting pixel, or a new payment processor, revisit the policy. Include an effective date and note when it was last updated so visitors and regulators can see it is current. Stale policies that no longer match your stack are a frequent source of complaints.
Where should the privacy policy live on your site? #
Convention and law both point to easy accessibility. The standard practice is a link labeled Privacy Policy in the footer of every page, so it is reachable from anywhere on the site without hunting. Beyond the footer, best practice is to surface the policy at the exact moments data is collected: a link next to a contact form, at checkout, in the newsletter sign-up box, and within any cookie banner. Under some laws, businesses that sell or share personal data must also provide a clearly labeled link such as Do Not Sell or Share My Personal Information. The policy should render properly on mobile, since most local searches happen on phones, and it should load quickly rather than as a slow, script-heavy page. Making the policy hard to find can itself be treated as a compliance failure. When we build or redesign a site through /services/web-design, we place these links consistently and make sure the required opt-out mechanisms are present and functional.
What are the risks of not having a proper policy? #
Skipping or faking a privacy policy exposes a business to layered risk. Regulators can pursue enforcement actions and fines; the FTC treats a policy that misrepresents data practices as a deceptive act, and state attorneys general enforce their own privacy statutes. Class-action lawsuits have targeted businesses over tracking technologies and data sharing. Beyond legal exposure, practical gatekeepers matter: Google, Apple, Meta, and payment processors can restrict or suspend accounts that lack a compliant policy, cutting off advertising and revenue. There is also reputational damage; a visible privacy failure erodes the trust that local businesses depend on. On top of that, a missing policy often signals broader security gaps, which is why we handle policies alongside broader protection under /services/website-security. The cost of getting a policy right is small compared with the downstream cost of a complaint, a takedown, or a breach that reveals your practices were never properly documented in the first place.
Do very small businesses and sole proprietors need one? #
Yes, in the vast majority of cases. The threshold that matters is not company size but whether you collect personal data, and almost every modern website does. A single-location salon with a contact form is collecting names and emails. A solo attorney using Google Analytics is collecting behavioral identifiers. A one-person e-commerce shop is collecting payment and shipping data. Some comprehensive state laws have revenue or volume thresholds that exempt the smallest operators from their strictest obligations, but exemptions are narrow, inconsistent between states, and do not cover the platform requirements from Google, Meta, or app stores. The reality is that publishing a clear, honest privacy policy costs little and removes a whole category of avoidable problems. For solo operators and small teams, the pragmatic move is to generate a policy at /tools/privacy-policy-generator, tailor it to the exact tools you use, keep it current, and, if you handle sensitive data, get professional review. It is basic hygiene, not overkill.
FAQ
Does every website need a privacy policy?
Nearly every one does. If your site collects any personal data, including names, emails, payment details, or analytics identifiers, privacy laws and platform rules effectively require a policy. Even the smallest local business with a contact form and Google Analytics is collecting data that triggers disclosure obligations under laws like the CCPA/CPRA.
Can I copy another company's privacy policy?
You should not. A policy must accurately describe your specific data practices, tools, and vendors. Copying someone else's usually results in a document that misstates what you actually do, which regulators can treat as deceptive. Use a generator as a starting structure, then customize it to your real stack.
What is the difference between a privacy policy and terms of service?
A privacy policy explains how you handle visitors' personal data. Terms of service set the rules for using your site or service, such as acceptable use, payment terms, and liability limits. One protects the visitor's privacy; the other protects the business. Many sites need both documents.
How often should I update my privacy policy?
Review it whenever you add or remove a tool that touches personal data, such as a new chat widget, ad pixel, or payment processor, and at least annually. Always include a last-updated date. A policy that no longer matches your actual practices is a common source of complaints and enforcement.
Where do I put the privacy policy link?
Standard practice is a Privacy Policy link in the footer of every page, plus links at the points where you collect data such as forms and checkout. If you sell or share data under state law, you may also need a clearly labeled opt-out link like Do Not Sell or Share My Personal Information.
Do I need a lawyer to write it?
A generator gives you a solid structured draft for a typical small business, which you then tailor to your real tools. For sensitive data such as health, financial, or children's information, or if you operate across many states or countries, having a qualified attorney review the policy is a worthwhile safeguard against costly mistakes.
Was this helpful?