Do you legally need a privacy policy?
There is no single American law that says every website must have a privacy policy. That fact gets repeated a lot, usually by someone about to argue they do not need one. It is technically true and practically useless, because the obligation arrives through four separate doors and you only have to walk through one of them.
Since 2004, California's Online Privacy Protection Act requires conspicuous policies on commercial sites collecting Californians' identifying data, with no size/revenue threshold. Contact forms qualify. Newer state laws and longstanding Nevada/Delaware rules similarly require notices.
European law applies cross-border as GDPR scope explains. Federally, FTC Act Section 5 treats misleading data-practice statements as deception, making inaccurate policies worse than none.
Tool contracts also require policies: Google Analytics/Ads require cookie disclosure; Meta Pixel, Mailchimp, Stripe, Calendly, and embedded booking widgets impose equivalent signup obligations.
The practical test
Forms, email signup, analytics, maps, videos, chat, or booking tools require policies, covering virtually every business site from the last decade. The question is whether yours accurately describes your site.
What on your site is collecting data
Before you can write an accurate policy you need an inventory, and most owners underestimate theirs by a wide margin. Data collection on a website falls into three buckets, and the third one is where the surprises live.
Contact forms, quote requests, newsletter signups, booking details, checkout information.
You know about thisAccess logs with IP addresses, browser strings, timestamps, and referring pages.
Runs by defaultAnalytics, ad pixels, embedded maps and video, fonts, chat widgets, review displays.
The blind spotThe first bucket is obvious. Someone types their name and email into a form and presses send. You know that happened because the email arrives. Under every privacy law on earth that is personal information and it needs to be disclosed, retained on a defined schedule, and deleted on request. Nothing subtle here.
Server-log IPs are GDPR personal data and personal information under most US state laws. Security/abuse prevention legitimately justify logs, but disclose them and define retention instead of keeping them indefinitely.
In plain English
Anything that can be tied back to a specific person, directly or by combining it with something else. Not just names and emails. Also IP addresses, device identifiers, and advertising cookies.
Doing anything at all with that data, including collecting it, storing it, looking at it, sending it somewhere, and deleting it.
Any company other than you whose code runs on your page. If their script loads, they see your visitor's IP address whether or not the visitor ever interacts with it.
Third-party code collects on load: YouTube and Google Maps contact Google before interaction; hosted fonts transmit IPs, underlying the German Google Fonts ruling. Chat usually sets cookies; review carousels bring tracking.
Twenty-minute audit: open private browsing, developer tools → Network, reload, and inspect outside domains receiving visitor data. Check Storage cookies next. Established small sites often contact six to fifteen domains, only half understood by owners. Analytics tag guide.
GDPR: when a US business is in scope
GDPR's maximum is 20 million euros or 4 percent global annual turnover, whichever higher. Claims that mere European website accessibility puts every US business in scope misstate the regulation.
Article 3 reaches non-EU organizations offering paid/free goods or services to EU people or monitoring their behavior. Recital 23 says accessibility alone doesn't establish targeting; apparent intent to serve them does.
Prices shown in euros or pounds. A language your domestic customers do not speak. EU countries named in your shipping options or service area. Ads bought against EU audiences. EU phone numbers or addresses. A country selector that includes EU states as delivery destinations.
Your site loads in Europe. Someone in Europe emailed you once. Your site is in English. You have a dot com domain. None of these establish intent to serve the EU market.
Behavioral analytics/ad profiling may count as monitoring visiting EU residents even without EU targeting. Typical US small-business exposure therefore comes from tracking tools, not sales strategy.
A five-page Tulsa roofer with forms/no analytics is sensibly out of scope. Google Analytics/Meta Pixel muddy matters by profiling Europeans too. Globally sold downloads clearly enter scope.
In-scope businesses need transparency, lawful processing bases, access/deletion responses within one month, and breach reporting to authorities within 72 hours of awareness. Seventy-two hours leaves little discovery time; security preparation inventories data beforehand.
Rule of thumb
If you do not want to think about GDPR, the reliable move is not a banner. It is building a site that does not track visitors in the first place. No behavioural analytics, no advertising pixels, no third party embeds, and the monitoring branch of Article 3 has nothing to grab hold of.
CCPA and the rest of the US state laws
The United States has no comprehensive federal privacy law, so the obligations come state by state. Roughly twenty states have comprehensive consumer privacy statutes in force as of 2026, and more take effect each year. They rhyme with each other without being identical, which is the whole problem.
California came first and remains the strictest. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a for profit business doing business in California that meets at least one of three thresholds.
Annual gross revenue above $25M. Straightforward, and it excludes almost every business reading this guide.
Buying, selling, or sharing the personal information of 100,000 or more California consumers or households in a year. Note that sharing for cross context behavioural advertising counts, which is how a site with heavy ad traffic and advertising pixels can trip this without selling anything.
Deriving 50% or more of annual revenue from selling or sharing personal information. Aimed at data brokers.
Statutory penalties under CCPA start at $2,500 per violation and rise to $7,500 for intentional violations or violations involving a minor, with the California Privacy Protection Agency adjusting those figures for inflation. Per violation means per consumer, which is how the arithmetic gets alarming quickly for a company that clears the thresholds.
Most small businesses clear none of the three tests and are simply out of scope in California. That is a real answer and you are allowed to rely on it. Two things stop it from being the end of the story.
Virginia, Colorado, Connecticut, and most others commonly use 100,000 annual residents or 25,000 plus meaningful data-sale revenue. Florida targets huge platforms. Texas instead covers personal-data processors doing Texas business unless federally SBA-small, without revenue/volume floors. Size, not data count, determines that exemption.
Rights converge: access, deletion, correction, portability, targeted-ad/sale/sharing opt-outs, sensitive-data opt-in, and no retaliation. Voluntarily honoring these satisfies most states together and avoids reassessing each new law.
Global Privacy Control silently sends browser-header sale/sharing opt-outs. Covered California/Colorado businesses must honor it; banner-only responses miss configured preferences. This motivates our do not sell or share page, despite selling no data.
Cookie banners: what they must do, what most get wrong
Cookie banners have become the most visible and least understood part of web privacy. The great majority of them are decorative. They appear, the visitor clicks whatever makes them go away, and nothing about the site's behaviour changes. That is not a neutral outcome, because the banner is a written record that you knew consent was required.
Necessary login sessions, shopping carts, anti-forgery security tokens, and server-affinity load-balancer cookies are consent-exempt everywhere. Don't gate them behind banners.
Everything else needs handling. Analytics cookies, advertising and retargeting pixels, social media embeds, session recording and heat mapping tools, A/B testing scripts, and most chat widgets are all non essential. Under the EU ePrivacy rules, consent must be obtained before those trackers are set, not after the page has loaded them.
- Reject is as easy as accept. Both choices on the first screen, same visual weight. Burying rejection two clicks deep behind a settings panel is the single most cited banner failure in European enforcement.
- Nothing is pre-ticked. The Court of Justice of the European Union settled this in the Planet49 case: a pre-checked consent box is not consent.
- Scripts wait. The tracking code does not run until the visitor says yes. This is a build detail, not a banner setting, and it is where most implementations fail.
- Withdrawal is as easy as giving. A persistent way to change the answer later, usually a small link in the footer.
- The banner has categories rather than one all-or-nothing switch. Not strictly required everywhere, but expected under EU practice and a good idea regardless.
- You keep a record of who consented to what and when. Under GDPR you must be able to demonstrate consent, which means logging it, not just acting on it.
- A banner with only an accept button, or one that says continued use of this site means you agree. Neither is consent under any European reading, and both are common on US small business sites.
- A banner sitting on a page whose analytics fired on load. This is the most common configuration in the wild and the least defensible.
Banners obscure pages, delay rendering, and cause bounces. Retargeting/lookalike audiences may justify that cost; unused analytics don't. Removing trackers removes consent-banner requirements and improves Core Web Vitals, since third-party scripts commonly dominate page weight.
Google advertising with EEA traffic requires Consent Mode v2 signals or audience features stop working. Consent-management platforms also see visitors; disclose them as third parties.
What belongs in your privacy policy
A privacy policy is not a legal shield. It is a factual statement about how your business handles data, and its usefulness depends entirely on being true. The clause list below is the floor. Getting the list right is the easy part. Keeping it accurate is the part that fails.
- What you collect, by category. Contact details, payment information, booking details, device and usage data, and anything you infer. Categories rather than an exhaustive field list.
- Where it comes from. Directly from the visitor, automatically from their browser, or from a third party such as an advertising platform or a lead source.
- Why you collect it. One stated purpose per category. Under GDPR you also name a lawful basis for each: consent, contract, legal obligation, or legitimate interests.
- Who you disclose it to. Categories of recipients, and in practice it helps to name the actual vendors. Your host, your email provider, your payment processor, your analytics provider, your booking tool.
- How long you keep it. A real schedule, per category. Form submissions for two years, server logs for 30 days, invoices for seven years because tax law says so.
- What rights people have and how to use them. A working email address or form, not a mailing address that nobody checks. Say how long you will take to respond.
- How you handle children's data. If your site is not aimed at children under 13, say so. COPPA is a separate federal statute with its own teeth.
- Where the data goes geographically. If your host, your CRM, or your email provider is in another country, say so. International transfer disclosure matters under GDPR and increasingly under state law.
- A last updated date and a change process. Undated policies read as abandoned, and a dated one is evidence of maintenance.
Policies usually fail through inaccuracy: three-year-obsolete cookies, missing last-spring bookings, unworkable 30-day deletion promises, or departed employees' bouncing contacts. These false data-practice statements fall squarely within FTC enforcement.
Copied policies misstate your vendors, retention, and legal bases, beyond copyright concerns. Generators depend on accurate input, not one-time launch questionnaires. Use the data inventory and recheck policies whenever it changes.
Use a stable policy URL linked in every footer and beside collecting forms, like ours. Review all legal pages through routine maintenance, not separate annual projects.
When a data request arrives
Sooner or later someone emails to ask what you hold about them, or to demand you delete it. The requests are usually polite and rarely adversarial. What makes them stressful is that the deadline started running the moment the email arrived, and most owners spend the first two weeks working out where their data even lives.
GDPR: one month, plus two for complexity with first-month notice. CCPA: acknowledge within 10 business days, respond within 45, extend 45 with notice. Other states usually allow 45 plus 45. A 10-business-day acknowledgement/45-day response satisfies nearly all.
-
Log it the day it lands day 0
Date received, who from, what they asked for, and which law they invoked if they said. One row in a spreadsheet is enough for a small business. Every deadline runs from receipt, not from the day you noticed the email under a pile of quote requests.
-
Verify who you are talking to days 1–5
Verify proportionately without overcollecting: email-on-file for newsletter requests, private account details for payment history. Never demand government ID for low-sensitivity matters; unnecessary identity documents create fresh privacy risks.
-
Find every copy days 5–20
This is the step that consumes the time. Your form submission inbox, your CRM, your email marketing list, your booking system, your accounting software, your payment processor, your support tool, and your backups. If you already built the data inventory, you know where to look. If you did not, this is where the 45 days goes.
-
Apply the exemptions you are entitled to
Deletion exemptions generally cover tax, accounting, warranty, safety, legal-defense, and requested-transaction records. Keep required paid invoices, stop marketing, and explain retained records/reasons.
-
Act, then write back describing exactly what you did
Specific beats vague. Say which systems you searched, what you found, what you deleted or exported, what you retained and under which exemption, and what happens next. A precise answer closes the matter. A vague one invites a follow up, and a follow up to a regulator is how a small request becomes a large one.
-
Keep the record
Store the request, your verification steps, what you did, and your response. Under GDPR you must be able to demonstrate compliance, and the same is true in practice under the state laws. The file is the proof, and it costs nothing to keep.
Decide beforehand whether to honor out-of-jurisdiction requests. One process usually costs less and preserves relationships better than separate Californian/other rules, avoiding location checks. Like owning accounts, a single clear arrangement beats conditional ones.
Building a site so compliance stays cheap
Everything above gets cheaper or more expensive depending on decisions made when the site is built. Privacy compliance is mostly an architecture problem wearing a legal costume. Data you never collect cannot be breached, cannot be requested, cannot be deleted incorrectly, and does not need a paragraph in your policy.
Every form field is a permanent obligation. If your quote form asks for a mailing address you never post anything to, delete the field. Data minimisation is an explicit GDPR principle and a practical risk reduction everywhere else.
Fonts served from your own server instead of a font CDN. A static map image instead of an embedded interactive map. A click-to-load thumbnail instead of an auto-loading video embed. Each swap removes a third party from the page and a disclosure from your policy.
Server log analysis and cookieless analytics answer most small business questions: which pages get traffic, where it came from, what converts. If nobody is building retargeting audiences, cookie based analytics is a compliance cost with no return.
Decide how long form submissions, logs, and backups live, and configure it once. A default of forever is a decision too, and it is the worst one available.
You cannot describe data flows you cannot see. A site whose code you own and whose host you control can be audited in an afternoon. A site assembled from twenty plugins whose vendors change their own data practices without telling you cannot.
Builders/plugins load unchosen, uninspectable third-party code whose updates alter sharing, a moving compliance target discussed in WordPress vs. custom. Hand-built sites load deliberately chosen domains. Our custom PHP sites start at $1,200 single-page or $2,800–$5,000 small multi-page, buying an enumerable inventory.
Hosting determines log retention and GDPR server-location disclosure. Our managed plans, from $60/mo flat, deliberately configure logs/backup lifetimes instead of defaults. Pricing and the cost guide explain overall costs.
Minimal collection/sharing lowers compliance costs, improves speed, and limits breach damage: privacy, speed, and security become three aspects of one decision. Accessibility likewise costs less built in. Put legal pages beside redirects/analytics on your launch checklist.
Not legal advice
This guide explains how these requirements work in practice from a web development perspective. It is not legal advice and does not create a lawyer client relationship. If you handle health data, financial data, children's data, or biometric data, or if you have received a demand letter or a regulator's inquiry, talk to a privacy lawyer in your jurisdiction.
Key takeaways
- Almost every business site needs a privacy policy, not because one federal law demands it, but because state law, the FTC's deception standard, and the terms of the tools you already installed all require one independently.
- Inventory before you write. Open your site in a private window, check the network tab, and list every outside domain it contacts. Most sites contact between six and fifteen, and most owners can explain about half.
- GDPR reaches US businesses that target the EU or monitor EU visitors' behaviour. Being reachable from Europe is explicitly not enough. Behavioural tracking is the branch most likely to catch a small US business.
- CCPA has three thresholds and most small businesses clear none of them. Texas is the outlier: it applies to anyone processing personal data who is not an SBA small business, with no revenue floor.
- A cookie banner only means something if the trackers wait for the answer. Reject must be as easy as accept, nothing may be pre-ticked, and the Global Privacy Control browser signal must be honoured where state law requires it.
- Policies fail on accuracy, not on missing clauses. A policy describing tools you removed and omitting tools you added is a false statement about your data practices, which is precisely the FTC's enforcement lane.
- Data requests run on short clocks: one month under GDPR, 45 days under most US state laws with acknowledgement in 10 business days. The time goes on finding the data, which is why the inventory matters.
- The cheapest compliance posture is architectural. Collect less, self-host what you can, choose analytics deliberately, set real retention periods, and own a stack you can enumerate.
Website privacy questions
Does a small business website legally need a privacy policy?
Practically yes when collecting data. No universal US federal policy law exists, but California's 2004 Online Privacy Protection Act covers commercial collection from residents, including forms. GDPR requires transparency for EU personal-data processing; newer US laws require collection notices. Google Analytics, Google Ads, Meta Pixel, Mailchimp, and Stripe impose contractual policies. Forms plus Google Analytics suffice. Ensure the policy reflects actual behavior.
Does GDPR apply to my US small business website?
GDPR Article 3 covers non-EU businesses targeting EU people or monitoring them; Recital 23 excludes mere accessibility. Targeting evidence includes euros, nonlocal languages, EU shipping/service areas, and EU ads. A five-page Ohio plumber with forms is almost certainly outside scope despite Berlin access; Ireland-shipping shops are inside. Behavioral trackers can independently trigger scope. Eliminating tracking is the cheapest way to remove that uncertainty.
Am I covered by CCPA if I have no California customers?
Usually not: CCPA/CPRA require California business plus one threshold: revenue above 25 million dollars; 100,000 consumers/households bought/sold/shared annually; or 50 percent revenue from selling/sharing. Most small firms miss all three. Advertising pixels can count as cross-context sharing. Other states differ: Texas covers processors unless SBA-small, without revenue floor. California exemption isn't universal exemption.
Do I need a cookie banner?
Consent banners are needed for nonessential trackers when visitors' laws require consent. Login/cart/security cookies are exempt; analytics, pixels, tracking videos, heatmaps, and chat aren't. EU ePrivacy requires prior consent; US states emphasize sale/sharing opt-outs and Global Privacy Control. Scripts must wait: already-fired trackers make banners evidence of knowingly ignored consent, worse than no banner.
What has to be in a privacy policy?
State data categories/sources/purposes, recipient categories, retention, rights/exercise procedures, children's requests, and monitored contacts. GDPR adds per-purpose lawful bases, applicable representatives, and supervisory complaints. Applicable US laws add collection-time notices and labeled sale/sharing opt-outs. Accuracy is crucial: obsolete cookies, omitted bookings, and dead contact addresses misdescribe actual practices, attracting regulatory/plaintiff scrutiny.
Can I just copy a privacy policy from another website?
Copying creates copyright and costly compliance risks: others' flows, vendors, and retention become false claims about you, fitting FTC Act Section 5/state consumer-protection deception. Generators share this weakness if inventories are wrong or stale. Inventory loaded tools, write/generate from it, and reassess whenever tools change.
What do I do when someone asks me to delete their data?
Log receipt immediately. GDPR allows one month plus two for complexity with first-month notice; CCPA acknowledgement within 10 business days, response within 45 plus another 45 with notice. Verify proportionately, never newsletter government ID. Find inbox/CRM/email-marketing/booking/accounting/backup copies. Retain permitted tax/warranty/legal-defense records, act, describe actions to the requester, and preserve the exchange as compliance evidence.
How much does privacy compliance cost for a small business site?
Minimal collection is cheapest. Contact-only brochure sites without analytics/pixels/widgets need accurate one-time policies, not banners/platform subscriptions. Consent platforms cost 10–100 dollars monthly; policy subscriptions similarly. Simple lawyer-drafted policies run high hundreds/low thousands. A dozen scripts accumulated over three years require expensive discovery. Data minimization begins in the build.