Disclosure: Some links are sponsored. We may earn a commission if you sign up or buy through them, at no extra cost to you. This is general information, not legal advice.
Last reviewed: by the Smart Savings Guides editorial team. How we research and update articles.
Not legal advice: this is a plain-English summary to help you ask the right questions. Which laws apply depends on where you and your visitors are, what data you collect and how big your business is. For anything high-stakes, talk to a lawyer licensed where you operate.
Quick answer
If your website collects personal information from visitors, such as names and emails through a contact form, newsletter signups, order details, or data gathered by analytics and ad tools, you should assume you need a privacy policy. Several laws require one, and services like Google Analytics, payment processors and app stores require one in their own terms too.
Want a generator to do the drafting?
Sponsored link: we may earn a commission if you buy through it, at no extra cost to you.
Opens Termly's privacy policy generator. The free plan covers one basic policy; paid plans are listed on Termly's Pricing page (Starter from $10 and Pro+ from $15 per website a month, billed annually, checked October 15, 2026). A generator only reflects your answers and isn't legal advice.
Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.
California: CalOPPA
The California Online Privacy Protection Act (Business and Professions Code sections 22575 to 22579) applies to operators of commercial websites and online services that collect personally identifiable information from California residents. There's no size threshold, so it reaches small businesses anywhere in the US that have California visitors. The policy must be posted conspicuously and must, among other things:
- list the categories of personal information you collect and the categories of third parties you share it with;
- explain how users can review and request changes to their information, if you offer that;
- explain how you notify users of changes to the policy, and give its effective date;
- say how you respond to browsers' "Do Not Track" signals, and whether other parties may collect information about users over time and across sites.
See the California Attorney General's privacy laws page.
California: CCPA, as amended by the CPRA
The California Consumer Privacy Act (amended by the California Privacy Rights Act) is much broader, but it only applies to for-profit businesses that do business in California and meet at least one threshold:
- annual gross revenue above $26,625,000 in the preceding calendar year (the original $25 million figure, adjusted for inflation from January 1, 2025);
- buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or
- deriving 50% or more of annual revenue from selling or sharing California consumers' personal information.
Most small businesses don't meet these thresholds, but CalOPPA still applies. Covered businesses need a more detailed privacy policy and must honor rights such as access, deletion, correction and opting out of the sale or sharing of personal information. Source: the California Privacy Protection Agency FAQ.
Other US states
A growing number of states, including Virginia, Colorado, Connecticut, Texas and others, have their own comprehensive privacy laws. Their thresholds and rules differ, and many apply only above a certain number of residents whose data you process. If you sell nationwide at scale, check the states where your customers live.
EU and UK: GDPR
The EU General Data Protection Regulation applies to businesses established in the EU, and also to businesses outside the EU that offer goods or services to people in the EU or monitor their behavior there (Article 3). Simply being reachable from Europe isn't enough on its own, but targeting EU customers (for example, EU shipping, euro pricing or EU-language marketing) can bring you in scope. The UK has its own near-identical version, the UK GDPR.
Articles 13 and 14 require you to tell people, among other things, who you are and how to contact you, what data you collect and why, your legal basis for each purpose, who receives the data, whether it goes outside the EU or UK, how long you keep it, and their rights (access, correction, deletion, objection, complaint to a regulator). Serious breaches can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher. Source: European Commission data protection pages.
Canada and Australia
In Canada, PIPEDA covers personal information collected in the course of commercial activity in most provinces, and requires openness about your privacy practices. Australia's Privacy Act generally applies to businesses with annual turnover over AU$3 million, plus some smaller businesses such as health service providers and those that trade in personal information.
What a small business privacy policy should cover
- Who you are and how to contact you.
- What you collect: form entries, order details, cookies, analytics, email signups.
- Why you collect it and, for GDPR, the legal basis.
- Who you share it with: hosting, email, payment, analytics and ad providers.
- How long you keep it and how you protect it.
- People's rights and how to use them.
- Cookies and tracking, Do Not Track, and children's data (in the US, COPPA applies to sites directed to children under 13).
- How you'll announce changes, and the effective date.
Whatever you write must match what your site actually does. A copied policy that describes tools you don't use, or leaves out ones you do, can itself be a problem: in the US the FTC treats misleading privacy statements as deceptive practices.
Sources
Official sources this article relies on, checked October 15, 2026. Rules and prices change, so confirm details at the source.
Recommended generator: Termly
We may earn a commission if you buy through these links, at no extra cost to you. This is a sponsored link.
Termly walks you through a questionnaire and builds a privacy policy (plus cookie, terms and other policies on paid plans) from your answers. Its free plan covers one basic policy and a cookie consent banner with up to 10,000 banner views a month. Paid plans are billed per website and add more policies, editing and automatic updates when laws change. Termly offers a 30-day money-back guarantee on paid plans.
Opens Termly's privacy policy generator. The free plan covers one basic policy; paid plans are listed on Termly's Pricing page (Starter from $10 and Pro+ from $15 per website a month, billed annually, checked October 15, 2026). A generator only reflects your answers and isn't legal advice.
The honest catch: a generator only describes what you tell it, so the policy is only as accurate as your answers, and it isn't a lawyer reviewing your business. Free alternatives exist too; see our generator vs lawyer guide. Our Termly partner link is set up for readers in the US. If you're outside the US, you can go to Termly's website directly.