Compliance guide

Do I Need a Privacy Policy for My Website?

Short answer: if your site collects any personal data — email addresses, analytics cookies, contact form submissions, even server logs — you almost certainly do. Here's which laws require it, what triggers the obligation, and exactly what the policy must say.

• Which laws require it
• What triggers the requirement
• What happens without one
• What it must say
• Generate yours free
• FAQ

Which laws require a privacy policy

No single global law requires a privacy policy, but several major frameworks do — and most public websites fall under at least one of them. The critical point these laws share: they apply based on where your visitors are, not where your server or company is located.

The practical takeaway: if your site is publicly accessible and collects any personal data, CalOPPA and GDPR are almost certainly in play simultaneously — and neither has a size or revenue threshold that would let a small site opt out.

What triggers the requirement

The requirement kicks in when you collect "personal data" — any information that can identify or be linked to a specific individual. This is broader than most people assume. You are almost certainly collecting personal data if your site has any of the following:

• A contact form — collects names, email addresses, and message content.
• Google Analytics, GA4, Plausible, Fathom, or any analytics tool — collects IP addresses and cookie identifiers. An IP address alone is personal data under GDPR.
• User accounts or login — collects email, password hash, profile data, and session identifiers.
• A newsletter or mailing list signup — collects email addresses and, via link tracking, open and click behavior.
• Payments (Stripe, PayPal, Lemon Squeezy, etc.) — even if you never touch card data, you receive the billing name, email, and country from the processor.
• A live-chat widget (Intercom, Crisp, Tawk, etc.) — these services set third-party cookies and log visitor data by default.
• Server-side hosting with access logs — Vercel, Netlify, Render, and most hosts log every HTTP request with the visitor's IP address and user-agent string.

If your site has any one of these, it is collecting personal data and you need a privacy policy. The only genuine exception is a completely static page with no analytics, no forms, no third-party scripts, and access logs disabled at the hosting level. Even then, if the page has any commercial purpose, CalOPPA likely applies.

What happens without one

The consequences are real and apply to small sites as well as large ones:

• GDPR fines — supervisory authorities (the ICO in the UK, the DPA in Germany, the CNIL in France) can issue fines up to €20 million or 4% of global annual turnover. Enforcement against small operators happens; it most often follows a user complaint.
• CalOPPA enforcement — the California AG can bring action against any commercial site without a conspicuous privacy policy link. Most enforcement targets larger operators, but the statute has no size floor.
• ADA demand letters — serial ADA filers who scan business websites for accessibility failures frequently bundle a CCPA allegation (missing privacy policy, missing "Do Not Sell" link) in the same demand. The two claims arrive together in a single letter. A missing policy is on the automated checklist alongside missing lang attributes and unlabeled form fields.
• App store rejection — both Apple App Store and Google Play reject submissions for any app that collects user data but doesn't link a privacy policy URL in the store listing.
• Google Ads policy violation — sending paid traffic to a landing page that collects data without a visible privacy policy link violates Google's advertising policies and can result in account suspension.

What your privacy policy must say

A legally adequate policy needs to cover the following. The list below satisfies the intersection of GDPR and CalOPPA/CCPA requirements — the two frameworks most likely to apply to a typical public website. For a detailed, section-by-section breakdown of each requirement, see What should a privacy policy include?

• What data you collect The categories of personal information — email, name, IP address, usage events, payment info. Be specific to what you actually collect; vague language creates the same liability as omitting a category.
• Why you collect it (purpose and legal basis) Under GDPR, each type of processing needs a stated legal basis — typically: legitimate interest (analytics), performance of a contract (order fulfillment), or consent (marketing email). Under CCPA, you disclose the "business or commercial purpose" for each category.
• Who you share it with (third-party processors) Name the processors and describe what they do: Google for analytics, Stripe for payments, Mailchimp for email, your hosting provider for server logs. Under CCPA, this section also discloses any "selling" or "sharing" of personal data for cross-context advertising.
• How long you keep it Retention periods by data type — e.g., account data until deletion request, server logs for 90 days, marketing email addresses until unsubscribe.
• User rights and how to exercise them Under GDPR: right to access, correct, delete, port, restrict processing, and object. Under CCPA: right to know, delete, correct, and opt out of data selling. Include a contact method for submitting requests — typically an email address.
• Contact information for the data controller Your name (or company name) and a reachable email address for privacy inquiries. GDPR requires a Data Protection Officer for certain organizations; most small sites are exempt, but the contact requirement is universal.
• Last updated date CalOPPA explicitly requires this. Update it whenever your data practices change — a new analytics tool, a new payment processor, expansion into a new region.

Generate yours free with ComplyKit

ComplyKit generates a privacy policy, terms of service, and cookie notice from a short questionnaire — entirely in your browser, with no data sent anywhere. You toggle on what your site actually does (analytics, user accounts, payments, which regions you serve), and the matching clauses are written in. Every item in the "what it must say" list above is covered in the output.

The generated documents are a genuine starting point, not generic boilerplate — every clause is conditional on your answers. For a complex situation (multiple regulated jurisdictions, sensitive data categories, a regulated industry), have a lawyer review before you publish. For most indie apps, side projects, and small business sites, the output covers what regulators and users expect to see.

Generate my privacy policy free →

Frequently asked questions

Also in the Copper Bay Labs ship-safety suite

A privacy policy is one of several things to audit before you ship. These free tools cover security, accessibility, and exposed secrets: