Website Privacy Policy
Tell visitors to your website or app what personal information you collect, how you use and share it, and what choices they have, in a clear policy built from your answers.
Includes 30 days of edits
- 5 to 20 minutes
- Print-ready PDF
What is a Website Privacy Policy?
A website privacy policy is a public notice that explains how the owner of a website or mobile app handles personal information. It describes what information is collected, such as names, email addresses, purchase details and data gathered automatically by cookies, why it is collected, who it is shared with, how long it is kept and how people can exercise control over it.
In the United States there is no single federal privacy law for websites, but several laws effectively require a posted policy. California requires commercial websites and online services that collect personal information from California residents to post one, and a growing number of states have comprehensive consumer privacy laws that require specific disclosures and give residents rights to access, delete or opt out of certain uses of their data. App stores, payment processors, analytics tools and advertising platforms also commonly require a privacy policy as a condition of using their services.
Beyond legal requirements, a clear privacy policy builds trust. Once published, it is also a promise: regulators such as the Federal Trade Commission can treat a business that does not follow its own posted policy as engaging in deceptive practices. This policy is built from your answers so that it describes what your site actually does.
When to use it
- You are launching a website, online store, blog or mobile app that collects any personal information, even just email addresses.
- You use analytics, advertising pixels, cookies or embedded third-party tools that gather visitor data.
- A platform you rely on, such as an app store, payment processor or advertising network, requires a posted privacy policy.
- You have visitors from states with consumer privacy laws, or from the European Union or United Kingdom.
- Your data practices have changed and your existing policy no longer describes them accurately.
What is included
- Who operates the site and how to contact them about privacy
- Categories of personal information collected and their sources
- Purposes for using personal information
- Cookies, analytics, Do Not Track and Global Privacy Control
- Who information is shared with and whether it is sold
- Retention, security and data breach response
- Children's privacy and minimum age
- Privacy rights and how to submit a request
- Optional California, other state and EU/UK sections
- How changes to the policy are announced
How to make your Privacy Policy
Answer the questions
Tell us about the parties and the terms you want. Most documents take about 5 to 20 minutes.
Review the preview
Check the draft as you go and change any answer. The document updates instantly.
Download, sign and keep a copy
Download a print-ready PDF, sign it with the other parties, and give everyone a copy.
Frequently asked questions
Is a privacy policy legally required for a website?
In many cases, yes. California requires commercial websites that collect personal information from its residents to post a privacy policy, and since most sites have at least some California visitors, the rule reaches businesses nationwide. Other state privacy laws, federal laws for specific industries and the terms of services like app stores and analytics tools add further requirements.
My site only has a contact form and analytics. Do I still need one?
Usually. A contact form collects names and email addresses, and analytics tools collect IP addresses and device information through cookies. Both count as personal information under most privacy laws, and many analytics providers require you to disclose their use in a privacy policy.
What is the difference between a privacy policy and terms and conditions?
A privacy policy explains how you handle personal information and is mainly a disclosure to visitors. Terms and conditions are the rules for using your site, such as acceptable use, payment terms and limits on your liability. Most websites publish both as separate pages.
Does this policy cover California and other state privacy laws?
You can include a California section describing the rights California residents may have, and a general section for residents of other states with comprehensive privacy laws. Whether those laws actually apply to your business depends on thresholds such as revenue or the number of consumers whose data you process, so check the laws that may apply or ask an attorney.
What are Do Not Track and Global Privacy Control?
Both are browser settings that let people signal that they do not want to be tracked. Do Not Track has no settled meaning, but California requires sites to disclose how they respond to it. Global Privacy Control is recognized under some state laws as a valid request to opt out of the sale or sharing of personal information.
Can I collect information from children?
Collecting personal information from children under 13 triggers the federal Children's Online Privacy Protection Act, which requires verifiable parental consent and other safeguards. This policy states that your site is not directed to children and that you do not knowingly collect their information. If your site is aimed at children, you will need a specialized policy.
Where should I post my privacy policy?
Link to it from the footer of every page, and also near the points where you collect information, such as sign-up forms, checkout pages and app download pages. Mobile apps typically link to it in the app store listing and within the app's settings.
How often should I update my privacy policy?
Review it whenever you add a new tool, start a new type of data collection or change how you share information, and at least once a year. Update the effective date each time, and notify users of material changes as your policy promises.
