Do You Have to Have a Privacy Policy on Your Website?

If your website collects any personal information from visitors, you almost certainly need a privacy policy. The clearest reason is California’s Online Privacy Protection Act, which applies to any commercial site or online service that gathers personal information from California residents, with no revenue floor and no small-business exemption.¹ Because virtually every U.S. site is accessible to at least one California resident, that single statute functions as a de facto national rule. Layer on the GDPR for European visitors, roughly twenty state consumer-privacy laws now in effect, and the terms of service for tools like Google Analytics, and the practical question is no longer whether you need a policy but what yours must say.

What Counts as Collecting Personal Information

The trigger is broader than most site owners assume. Personal information includes the obvious categories, such as names, email addresses, phone numbers, and billing details, but it also covers digital identifiers like IP addresses, device IDs, and data captured through cookies or analytics scripts. Running a contact form, an e-commerce checkout, user accounts, a newsletter signup, or even a basic analytics tool means you are collecting this kind of data. Once you are collecting it, at least one legal or contractual obligation almost certainly requires a posted privacy policy.

California’s Online Privacy Protection Act

CalOPPA is the broadest privacy-policy mandate in the country. There is no revenue threshold, no minimum user count, and no exemption for hobby sites that happen to be commercial. If your site collects personal information and a single California resident visits it, CalOPPA requires you to conspicuously post a privacy policy. The law also prescribes content: your policy must identify the categories of personal information you collect, the categories of third parties you share it with, your process for notifying users of material changes, the policy’s effective date, and how you respond to browser “do not track” signals.¹

The CCPA and Other State Laws

The California Consumer Privacy Act adds obligations on top of CalOPPA for larger businesses. Unlike CalOPPA, it uses thresholds: it applies to for-profit businesses doing business in California that have gross annual revenue of at least $26.625 million, buy or sell the personal information of 100,000 or more California residents, or derive at least half their annual revenue from selling or sharing personal data.² If you meet any one of those, you owe more than a policy: you have to honor opt-out requests and provide data access and deletion rights.

California is not alone. As of 2026, roughly twenty states have enacted comprehensive consumer-privacy laws, including Virginia, Colorado, Connecticut, and Texas. Thresholds vary, but a common pattern is that they apply when a business processes data from 100,000 or more state residents, or from 25,000 or more residents while deriving a significant share of revenue from selling that data. Several also require sites to honor universal opt-out signals like Global Privacy Control.

The GDPR for European Visitors

Europe’s General Data Protection Regulation protects people located in the EU and applies to any website worldwide that offers them goods or services or monitors their online behavior.³ If your site is reachable in Europe and uses analytics or advertising cookies that track visitor behavior, the GDPR is in play. It requires detailed disclosures including the legal basis for processing data, the specific retention period, the identity of your data controller, and a full list of the rights users can exercise.⁴

The FTC Act as a Federal Baseline

Even where no specific privacy statute reaches you, Section 5 of the FTC Act declares unfair or deceptive practices in commerce unlawful.⁵ The Federal Trade Commission has repeatedly used this authority against companies that collect user data without adequate disclosure or that promise privacy protections and then fail to follow through.⁶ A site collecting personal data with no privacy disclosure risks an enforcement action for deceptive practices even if it falls below every state-law threshold.

Third-Party Tools That Require a Policy on Their Own

This is the part site owners overlook most often. Even if you could argue no statute applies, the tools you use to run the site probably impose the requirement contractually. Google Analytics is the clearest example. Section 7 of its Terms of Service states that you must post a privacy policy giving notice of your use of cookies and similar technology, and you must specifically disclose your use of Google Analytics and how it collects and processes data.⁷ Advertising networks like Google AdSense, payment processors like Stripe and PayPal, and social media login or sharing plugins impose similar terms. Violating them can cost you access to the service.

A personal blog with no contact form and no checkout might plausibly argue it sits outside CalOPPA or the CCPA. The moment that blog installs Google Analytics to count visitors, the contractual obligation kicks in. Together, statutes and vendor terms leave almost no commercial site outside the requirement.

What the Policy Has to Say

Requirements vary by which laws apply, but a well-drafted policy covers all of them at once. It should answer five questions a visitor could reasonably ask: What data do you collect? Why do you collect it? Who else sees it? How do you protect it? What can I do about it?

Categories of Data Collected

List every category of personal information the site gathers. That includes data visitors provide directly, such as names, email addresses, phone numbers, and billing details, plus data collected automatically through cookies and analytics tools, such as IP addresses, browser type, device identifiers, and pages visited. If you collect anything in a sensitive category, such as precise geolocation, government-issued IDs, health information, or biometric data like facial geometry or voiceprints, call it out specifically. Several state laws impose heightened consent requirements for sensitive data.

Purpose and Legal Basis

For each type of data, explain why you collect it and how. A reader should be able to connect a specific piece of information to a clear business reason: email for order confirmations, shipping address to fulfill purchases, cookies to remember login sessions or serve ads. The GDPR goes further and requires you to state the legal basis for each type of processing, such as user consent, performance of a contract, or a legitimate business interest.⁴

Third-Party Sharing and Data Sales

Disclose the categories of outside parties that receive user data, such as payment processors, email service providers, or advertising partners. If you sell or share personal information for targeted advertising, California law requires you to say so explicitly and provide opt-out instructions. Businesses subject to this requirement must also display a conspicuous link labeled “Do Not Sell or Share My Personal Information” or “Your Privacy Choices.”²

Security and Retention

Describe the measures you use to protect stored data, such as encryption and access controls. State how long you retain personal information and what triggers deletion. Vague language like “we retain data as long as necessary” tends to draw regulatory scrutiny. Better to specify concrete timeframes tied to purpose, such as retaining purchase records for seven years for tax compliance.

User Rights and How to Exercise Them

Users under most privacy laws have the right to access the personal information you hold, correct inaccuracies, and request deletion. Your policy must describe these rights and give a working method for exercising them, whether an email address, an online form, or a toll-free number. CalOPPA requires that if you offer a review-and-correction process, you describe it in the policy.¹ The GDPR adds the right to data portability, the right to object to processing, and the right to lodge a complaint with a supervisory authority.⁴

Effective Date and Notice of Changes

CalOPPA requires every privacy policy to display its effective date and describe how you will notify users of material changes.¹ A simple statement that changes will be posted on the page with an updated effective date at the top satisfies the requirement for most businesses.

If Your Site Is Directed at Children

If your website or app is directed at children under 13, or if you have actual knowledge that you are collecting data from children under 13, the federal Children’s Online Privacy Protection Act adds a separate layer. COPPA requires you to post a clear privacy policy describing your data practices for children’s information, provide direct notice to parents, and obtain verifiable parental consent before collecting a child’s personal data.⁸ Verifiable consent means more than a checkbox: acceptable methods include a signed consent form, a credit card transaction that generates a notification to the account holder, or a call to a toll-free number staffed by trained personnel.⁹ Civil penalties for COPPA violations can reach $53,088 per violation.

Where to Put the Policy on Your Site

A privacy policy buried three clicks deep is almost as bad as not having one. The standard placement is a clearly labeled “Privacy Policy” link in the site footer, visible on every page. CalOPPA specifically requires the policy to be conspicuously posted, which courts have interpreted to mean a link that is easy to find and clearly identified.¹

A footer link is the minimum. Wherever your site actively collects data, next to a signup form or before checkout, include a direct link at that point of collection. For stronger legal protection, require an affirmative action such as ticking a box that says “I have read and agree to the Privacy Policy” before submitting information. This clickwrap approach is far more enforceable than a passive footer link. Courts have been skeptical of browsewrap arrangements, where a site assumes consent just because the user kept browsing, especially when the terms link was visually inconspicuous.

What Happens if You Skip It

The financial consequences of no policy, or an inadequate one, range from annoying to existential depending on which regime catches you.

GDPR Fines

The GDPR carries the heaviest penalties. For violations of core data-processing principles or data-subject rights, fines can reach €20 million or 4% of the company’s total worldwide annual revenue from the preceding year, whichever is higher.¹⁰ EU regulators have used this authority against companies of all sizes, not just tech giants.

California Penalties

Under the CCPA, the California Privacy Protection Agency can impose administrative fines of up to $2,663 per violation or $7,988 for each intentional violation and violations involving minors’ data, adjusted annually for inflation.¹¹ Because fines apply per violation, a single data-handling failure affecting thousands of users can add up fast. California also gives consumers a private right of action after a data breach caused by a business’s failure to maintain reasonable security, with statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater.¹²

CalOPPA enforcement works differently. An operator is only in violation if it fails to post a compliant policy within 30 days after being notified of noncompliance.¹ Once that 30-day window closes, the state attorney general can bring enforcement actions.

FTC and COPPA Enforcement

The FTC does not impose fines for a first-time Section 5 violation the way the GDPR does, but it can seek injunctions requiring businesses to change their practices, and, for repeat violations or consent-order breaches, substantial monetary penalties. COPPA violations carry civil penalties of up to $53,088 per violation, and the FTC has brought actions producing penalties in the tens of millions against companies that collected children’s data without proper consent.⁸

Losing Access to Your Platforms

Set fines aside for a moment. Failing to maintain a compliant policy can get you removed from the platforms your business runs on. Google can suspend your Analytics or AdSense account. Payment processors can terminate your merchant account. App stores can pull your app. For many online businesses, losing these services stops revenue overnight and hurts faster than any regulator would.

Keeping the Policy Current

A privacy policy is not a document you post once and forget. Every time you add a new analytics tool, share data with a new vendor, change your retention practices, or start collecting a new category of information, the policy needs to reflect the change. CalOPPA requires you to describe in the policy itself how you will notify users of material changes.¹

Review the policy at least once a year even if nothing obvious has changed. Vendors update their own practices, new state laws take effect, and analytics tools add features that quietly change what data they collect. An annual review catches the drift that builds up when small changes accumulate without anyone updating the disclosure.

1
California Legislative Information. California Code BPC 22575
2
California Privacy Protection Agency (CPPA). Frequently Asked Questions (FAQs)
3
European Commission. Who Does the Data Protection Law Apply To?
4
GDPR-Info.eu. Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected
5
Office of the Law Revision Counsel. 15 USC 45 – Unfair Methods of Competition Unlawful
6
Federal Trade Commission. A Brief Overview of the Federal Trade Commission’s Investigative, Law Enforcement, and Rulemaking Authority
7
Google. Google Analytics Terms of Service
8
Federal Trade Commission. Complying with COPPA: Frequently Asked Questions
9
eCFR. 16 CFR 312.5 – Parental Consent
10
GDPR-Info.eu. Art. 83 GDPR – General Conditions for Imposing Administrative Fines
11
California Privacy Protection Agency (CPPA). Updated Monetary Thresholds in CCPA
12
California Attorney General’s Office. California Consumer Privacy Act (CCPA)