Why you probably need one
This isn’t legal advice. Businesses in health care, finance or anything regulated have specific rules and should involve their attorney.
- Laws. Several states require a posted privacy policy from sites that collect personal information from their residents; California’s law applies to any site with California visitors whose information it collects, wherever the business is.
- The tools you use. Google Analytics, Google Ads and Meta’s advertising tools require you, in their terms, to disclose that you use them.
- Payments and forms. If you take card payments or collect anything sensitive, your processor and your customers will expect one.
- Trust. A credit application or patient form on a site with no privacy policy is a red flag to anyone who notices. We’ve found exactly that on local sites this year.
What it should cover
- What you collect: form entries, emails, phone numbers, payment details, and what analytics and ad tools collect.
- Why, and what you do with it.
- Who you share it with: your email provider, payment processor, booking tool, analytics.
- How long you keep it and how you protect it.
- How someone can ask to see or delete their information, and how to contact you.
- The date it was last updated.
The copy-paste problem
A privacy policy copied from another site, or generated for a generic business, often describes tools you don’t use and misses the ones you do. That can be worse than nothing, because it makes promises your site doesn’t keep. Write it from what the site really does, and update it when the site changes.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.