Here's the short answer: if your business has a website and collects any information from visitors — even just through cookies or analytics — you almost certainly need a privacy policy. And it's not just a nice-to-have. Multiple laws require it.
Which Laws Require a Privacy Policy?
CalOPPA — if your website is accessible to California residents (virtually every website), you must conspicuously post a privacy policy. This applies regardless of where your business is located.
CCPA/CPRA — if you meet CCPA thresholds, your privacy policy must include specific disclosures about categories of data collected, purposes, and consumer rights.
GDPR — if any EU residents visit your site, you must provide a clear privacy notice explaining your data processing and legal basis.
COPPA — if your site is directed at children under 13, a privacy policy is mandatory with specific disclosures.
Platform requirements — Google Play, Apple App Store, Google Ads, Facebook Ads, Shopify, and many other platforms require a privacy policy URL to use their services. No privacy policy = no ads.
What Must a Privacy Policy Include?
- What data you collect — names, emails, IP addresses, cookies, payment details, location data. List everything.
- How you collect it — forms, cookies, analytics, third parties
- Why you collect it — service delivery, payments, marketing, analytics, legal compliance
- Who you share it with — service providers, analytics partners, advertisers, payment processors
- How you protect it — encryption, access controls, secure hosting
- User rights — access, deletion, correction, opt-out and how to exercise them
- Cookie usage — what cookies, their purpose, how to manage them
- Data retention — how long you keep data
- Contact information — how to reach you with privacy questions
Need a privacy policy right now? Our free generator creates a customized policy based on your business type and data practices — no signup required.
Generate Free Privacy Policy →Where to Display Your Privacy Policy
CalOPPA requires it to be "conspicuously posted." Best practices:
- Link in your website footer (on every page)
- Link during account registration or checkout
- Link in your app's settings or about section
- Link in your email marketing footer
- Submit to app stores if you have a mobile app
5 Common Privacy Policy Mistakes
- Using a template without customizing it — a policy that doesn't match your actual practices creates legal liability
- Being too vague — "we may collect certain information" doesn't satisfy legal requirements
- Forgetting third-party services — if you use Google Analytics, Stripe, or Mailchimp, your policy must disclose it
- Not updating it — when your data practices change, the policy must change too
- Making it impossible to find — burying the link fails the "conspicuously posted" requirement
A privacy policy is only useful if it's truthful. Always review the final document to make sure it accurately reflects what your business actually does with user data.