01When a privacy policy is required
Privacy laws turn on whether you collect personal information, not on your size. A contact form that takes a name and email address counts. So do analytics tools that set cookies or record IP addresses, newsletter sign-ups, orders and account registrations.
| Law | Applies when | Key requirement |
|---|---|---|
| California's online privacy law (CalOPPA) | Commercial site collects personal information from California residents | Post a privacy policy conspicuously |
| EU GDPR | You process personal data of people in the EU | Explain what, why, how long, and people's rights |
| Other US state privacy laws | Varies by state and business size | Disclosures and rights; check thresholds |
02California and the EU in more detail
California's Business and Professions Code section 22575 requires operators of commercial websites that collect personally identifiable information from California residents to conspicuously post a privacy policy describing what they collect and who they share it with. Because a website is visible everywhere, many US businesses outside California follow it.
The EU's GDPR, in Article 13, lists what you must tell people when you collect their data: who you are, why you collect it, the legal basis, who receives it, how long you keep it and their rights, among other things. It applies when you process data of people in the EU, which can include a US business's site visitors.
03What a privacy policy should cover
- Who you are and how to contact you about privacy.
- What personal data you collect, including through cookies and analytics.
- Why you collect it and how you use it.
- Who you share it with, such as email, payment or analytics providers.
- How long you keep it.
- People's rights and how to exercise them.
- When you last updated the policy.
04How to create one
- 1List every data pointForms, analytics, embeds, payment, newsletter tools, ads pixels.
- 2List every providerEach service that receives the data.
- 3Use a reputable generator or templateThen edit it to match what you actually do.
- 4Link it in the footerAnd near forms that collect data.
- 5Review it when tools changeAdding a new analytics or chat tool may change what you disclose.
05Common mistakes in small business privacy policies
The usual problems are copying a large company's policy that describes data practices the business does not have, forgetting tools added later (a chat widget, an ad pixel, a booking system), hiding the link where nobody can find it, and never updating it. A policy is a description of what you actually do, so it should change whenever your tools do. Keep a simple list of every service your site sends data to and check it against the policy once or twice a year.
What people who tried it say
Hacker News threads about running a website without legal trouble commonly recommend a clear privacy policy, minimal tracking and honest disclosures, and warn that copied policies describing things a site does not do are a liability of their own.
- Ask HN: How do I make a website in 2023 and not get sued?Hacker News
Commenters list privacy policies, cookie consent for EU visitors, accessibility and minimal data collection as the main areas to get right.
Looking for more first-hand opinions? Search Reddit for “does a website need a privacy policy”. We link the live threads rather than summarizing them, so you read them in full.
Our take
write a short, honest policy that matches what your site actually does, and collect less data. The easiest privacy policy to keep accurate is one with little to disclose.
Where this falls short
This is general information, not legal advice. Privacy law varies by country and US state, changes frequently and depends on your business size and data practices; consult a lawyer for anything beyond a simple site.
Sources
- 1.California Business and Professions Code section 22575 · California Legislature
- 2.Art. 13 GDPR: Information to be provided where personal data are collected · gdpr-info.eu
Researched and written by the Orlume team · Updated October 2026
Still stuck?