Are privacy policies required by law? There is no single federal statute that forces every U.S. business to post one, but a web of federal sector laws, state statutes, international rules, and platform requirements covers so much ground that almost every business collecting personal information online ends up needing a privacy policy in practice. As of 2026, roughly 20 states have enacted comprehensive consumer privacy laws, federal statutes like COPPA, HIPAA, and the Gramm-Leach-Bliley Act impose notice duties on specific industries, and the Federal Trade Commission treats broken privacy promises as deceptive practices. That last piece alone gives a federal regulator enforcement reach over virtually any business that handles consumer data.
Federal Laws That Directly Require a Privacy Notice
Three federal statutes single out specific industries and require them to tell people what happens to their data.
COPPA (Children Under 13)
The Children’s Online Privacy Protection Act applies to operators of websites or online services aimed at children under 13, and to any site that knows it is collecting information from a child under 13. If either applies, the operator must post a clear, complete privacy policy describing what data it collects, how it uses that data, and its disclosure practices.1Federal Trade Commission. Children’s Online Privacy Protection Rule The rule also requires verifiable parental consent before collecting a child’s personal information.2eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule
HIPAA (Healthcare)
Healthcare providers, health plans, and healthcare clearinghouses have to give patients a written notice of privacy practices explaining how protected health information may be used and disclosed, and describing patients’ rights to access, amend, and request restrictions on their records.3U.S. Department of Health and Human Services. Notice of Privacy Practices for Protected Health Information This is a standalone legal document, typically handed to patients at the first visit, and separate from any website policy.
GLBA (Financial Institutions)
Banks, credit unions, broker-dealers, insurance companies, and other financial institutions must give a privacy notice when a customer relationship begins and at least once a year afterward. The notice must describe the categories of personal financial information collected, the types of third parties it may be shared with, and the institution’s data-protection practices.4Office of the Law Revision Counsel. 15 USC 6803 – Disclosure of Institution Privacy Policy Institutions that don’t share data with outside parties and haven’t changed their practices since the last notice can skip the annual mailing, but the initial notice is always required.
Why the FTC Makes a Privacy Policy a Practical Necessity
If your business isn’t in one of those three sectors, you are still within reach of the Federal Trade Commission. Section 5 of the FTC Act declares “unfair or deceptive acts or practices” in commerce unlawful and gives the FTC broad authority to enforce that prohibition.5Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful
Two consequences flow from that for privacy policies. If you post one and then don’t follow it, the FTC can sue you for deception. And if you collect sensitive data and fail to protect it, the FTC can pursue you for unfair practices whether or not you have a policy in place. The FTC has been the primary federal agency on privacy enforcement since the 1970s and regularly brings cases against companies that misrepresent their data practices or fail to safeguard consumer information.6Federal Trade Commission. Privacy and Security Enforcement Skipping a policy doesn’t remove you from scrutiny, and posting an inaccurate one creates its own liability. For most businesses collecting personal data, the safest path is a truthful, up-to-date policy.
State Laws That Reach Businesses Nationwide
State legislatures have moved aggressively on privacy. Around 20 states now have comprehensive consumer privacy statutes, and California’s two laws carry the broadest practical reach.
CalOPPA
California’s Online Privacy Protection Act requires any operator of a commercial website or online service that collects personally identifiable information from California residents to conspicuously post a privacy policy.7California Legislative Information. California Business and Professions Code 22575 Because almost every commercial website attracts some California visitors, CalOPPA functions as a de facto national requirement.
The policy has to identify the categories of personal information collected, list the types of third parties data may be shared with, describe how the operator handles “do not track” browser signals, and include the effective date. An operator is only in violation if it fails to post a policy within 30 days after being notified of noncompliance, which gives a short cure period before penalties attach.
CCPA
The California Consumer Privacy Act, as expanded by the California Privacy Rights Act, goes further than CalOPPA. It applies to for-profit businesses doing business in California that meet at least one of three thresholds:
- Annual gross revenue exceeding $26,625,000, adjusted periodically for inflation8California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
- Annually buying, selling, or sharing the personal information of 100,000 or more consumers or households
- Deriving 50 percent or more of annual revenue from selling or sharing consumers’ personal information9California Legislative Information. California Civil Code 1798.140
Covered businesses must tell consumers, at or before collection, what categories of personal information they are gathering, why, whether the information will be sold or shared, and how long each category will be kept.
The Rest of the Country
Virginia, Colorado, Connecticut, Texas, Oregon, Indiana, Kentucky, Rhode Island, and more than a dozen other states have passed their own comprehensive privacy laws, many taking effect between 2023 and 2026. Details vary, but the framework is consistent: businesses that process personal data above certain volume thresholds must give a clear, accessible notice describing what data they collect, why, who they share it with, and what rights consumers have. Thresholds differ, with some laws applying at 25,000 consumers when a significant share of revenue comes from data sales and others setting higher floors. Any business with a national online presence should assume some of its users live in states with these requirements.
When the GDPR Applies to U.S. Businesses
The European Union’s General Data Protection Regulation reaches U.S. businesses in two situations: when they offer goods or services to people in the EU, including free ones, and when they monitor the behavior of people located in the EU.10GDPR-Info. Art. 3 GDPR – Territorial Scope Either trigger requires extensive transparency disclosures that function as a privacy policy. The notice must state the legal basis for processing, the identity and contact details of the data controller, the retention period, the right to complain to a supervisory authority, and whether any automated decision-making or profiling takes place.11GDPR-Info. Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected
Shipping to EU customers, running targeted ads in EU markets, or using analytics that track EU visitors can all pull a U.S. company into the regulation. There is no physical EU presence requirement, and fines can reach 4 percent of global annual revenue. Many U.S. businesses that aren’t sure whether the GDPR applies to them are better off complying than guessing.
App Stores Require One Regardless of the Law
Publishing an app triggers a privacy policy requirement through platform rules even if no statute reaches you. Apple requires every App Store submission to include a link to a privacy policy in both the store listing and the app itself, explaining what the app collects, confirming that third-party partners provide the same level of data protection, and describing retention and deletion practices.12Apple Developer. App Review Guidelines
Google Play works similarly. Apps that request access to sensitive permissions or data must link to a privacy policy on the store listing and inside the app, and apps targeting children need one regardless of the permissions requested.13Google. Prepare Your App for Review – Play Console Help Missing or non-compliant policies can get an app pulled or lose it monetization features. Not a legal mandate, but the commercial consequences are just as real.
What a Privacy Policy Has to Cover
Specifics vary by law, but most statutes converge on the same core disclosures. A policy that satisfies the strictest law that applies to you will generally satisfy the others. At minimum, the policy should address:
- The categories of personal information you collect, whether names, email addresses, browsing activity, purchase history, or geolocation data.
- How you collect it, whether directly from users, through cookies and tracking technologies, or from third parties.
- The business purposes for each category of data.
- The categories of third parties that receive the information, such as service providers, advertising partners, or affiliates.
- Retention periods, or the criteria used to set them.
- Consumer rights over the data, such as access, correction, deletion, or opting out of sale.
- A way for consumers to submit requests or ask questions.
If the GDPR applies, add the legal basis for each processing activity, the identity of the data controller, cross-border transfer details, and information about automated decision-making. HIPAA-covered entities have a separate notice of privacy practices with its own format requirements. Privacy policies are not one-size-fits-all, and a generic template can leave you non-compliant with the specific law that applies to your situation.
Penalties for Skipping It or Getting It Wrong
Consequences range from regulatory fines to federal enforcement actions. Under the CCPA, each violation can trigger fines of up to $2,663 for unintentional violations and $7,988 for intentional ones, applied per violation, with each affected consumer potentially counting separately.14California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties Consumers can also bring private lawsuits for certain data breaches, with statutory damages between $100 and $750 per consumer per incident.
COPPA carries steeper per-violation penalties, and the FTC has imposed multi-million-dollar settlements on companies that collected children’s data without proper notice and consent. FTC enforcement under Section 5, while not tied to a per-violation schedule, has produced some of the largest privacy-related penalties in U.S. history. State attorneys general also actively pursue privacy cases and have secured settlements reaching into the hundreds of millions of dollars.6Federal Trade Commission. Privacy and Security Enforcement
Enforcement actions are also public. An FTC consent decree or a state attorney general settlement signals to customers, partners, and investors that a company mishandled personal data, and that reputational cost tends to outlast the fine. For most businesses, drafting and maintaining an accurate privacy policy is cheap next to the cost of getting caught without one.