A privacy policy is a page on your website that tells visitors, in writing, what personal information you collect about them, what you do with it, who else gets it and what rights they have. It is a disclosure, not a contract: its job is to be honest and complete about how data flows through your business.
What a privacy policy has to cover
Most laws ask for roughly the same building blocks:
- The data you collect: names and emails from forms, order details, IP addresses, data gathered by cookies and analytics.
- Why you collect it, and under GDPR the legal basis for each purpose (consent, contract, legitimate interest and so on).
- Who receives it: payment processors, email platforms, hosting providers, ad networks.
- How long you keep it and where it is stored or transferred.
- How people can access, correct, delete or opt out, and how to contact you.
The page is usually linked from the footer of every page and near any form that collects data.
Is it legally required?
Often, yes. GDPR requires clear privacy information whenever you process personal data of people in the EU, and the UK has an equivalent. California's CalOPPA requires a posted policy for commercial sites that collect personal information from California residents, and the CCPA adds more duties for larger businesses. Beyond the law, platforms demand one: Google's ad and analytics terms, Apple's and Google's app stores, and Meta's advertising tools all expect a published policy. Exact thresholds differ by country and change, so a lawyer is the right source for edge cases.
What a dog groomer's policy should name
A dog groomer's site has a booking form, Google Analytics, a Mailchimp newsletter signup and Stripe for deposits. Their policy should name each one: booking details are used to schedule appointments, analytics records anonymised visit data, the newsletter list lives in Mailchimp until someone unsubscribes, and card payments are handled by Stripe, which the groomer never sees in full. A visitor can then judge exactly what happens when they book.
Where privacy policies go wrong
- Copying another company's policy. It will describe tools and practices you do not have, and miss the ones you do.
- Never updating it. Adding a chat widget or ad pixel changes what you collect; the policy should change too.
- Burying it. A policy nobody can find does not do its job; link it where data is entered.
- Promising things you do not do, such as "we never share data" while running ad retargeting.
Keep it separate from your terms of service, which set the rules for using your site rather than describing data handling.
Related terms
- GDPR: the EU law that sets the strictest disclosure rules.
- CCPA: California's consumer privacy law.
- Cookie: one of the main things a policy must disclose.
- Terms of service: the companion page covering usage rules.