Does Your Website Need a Privacy Policy?
If your website collects any personal information, even just a name and email through a contact form, you should have a privacy policy. Many laws and many tools you already use expect one. This guide is a plain-English overview, not legal advice.
When you need one
In the United States, California's Online Privacy Protection Act (CalOPPA) requires commercial websites that collect personal information from California residents to post a privacy policy, and that covers most US business sites. If you serve visitors in the European Union or UK, their data-protection laws (GDPR and UK GDPR) apply as well. Analytics and advertising tools usually require one too: Google Analytics' terms, for example, ask sites to disclose that they use it.
What a privacy policy should cover
Say what information you collect (contact forms, newsletter sign-ups, orders, cookies), why you collect it, who you share it with (email service, payment provider, analytics), how long you keep it, how people can ask to see or delete their data, and how to contact you. Add the date of the last update.
Cookies and analytics
If your site uses analytics or advertising cookies, explain them in the policy. Visitors in some places, such as the EU and UK, must be asked for consent before non-essential cookies are set. A site with no tracking at all has much less to explain.
Keep it honest and current
Do not copy another company's policy word for word; it will describe tools you do not use. Review the policy whenever you add a new form, tool or plugin. Link it in the footer of every page and next to any form that collects personal details. For anything complex, ask a qualified lawyer.
Quick checklist
- List every tool that receives visitor data: forms, email, analytics, payments.
- Link the privacy policy in the footer of every page.
- Update the policy when you add a new tool or form.
- Ask a lawyer if you handle health, financial or children's data.
Frequently asked questions
Do I need a privacy policy if I only have a contact form?
Yes, it is a good idea. A contact form collects personal information, and laws such as CalOPPA expect a posted policy when you collect it.
Can I use a free privacy policy template?
A template can be a starting point, but edit it so it describes the tools and data your site really uses.
Where should the privacy policy link go?
In the footer of every page and next to forms that collect personal details.
