A privacy policy is legally required for most US commercial websites and every app in the major stores: California's CalOPPA applies to any site that reaches California residents, state privacy laws from California to Texas add disclosure duties, and Apple, Google, Stripe, and ad networks all refuse services without a linked policy.
This template produces a plain-English policy covering data collected, cookies, third-party sharing, sale and opt-out, user rights, retention, and children's privacy, tailored to your answers rather than copied from a competitor's site.
Who actually requires a privacy policy
- State privacy laws: CalOPPA requires a conspicuous policy from any commercial site collecting Californians' data. Comprehensive laws in California, Colorado, Connecticut, Texas, Virginia, and a growing list of states add rights of access, deletion, and opt-out that the policy must disclose.
- Platforms and processors: the Apple App Store and Google Play require a policy URL for every app, and payment processors, ad networks, and analytics providers require one in their terms of service.
- The FTC: under Section 5 of the FTC Act, saying one thing in a policy and doing another is a deceptive practice. The policy must match your real data flows, which is why this template asks what you actually collect instead of generating boilerplate.
Getting the substance right
Start from an inventory, not from wording: list every form, account system, analytics tag, pixel, and support channel, and what each one captures. The two questions that most affect your legal duties are whether you sell or share data for targeted advertising, which triggers opt-out obligations under CCPA-style laws, and whether children under 13 are part of your audience, which triggers COPPA's parental-consent regime. Answer both honestly in the form; the template writes the matching clauses.
Retargeting pixels count as sharing
Under California's rules, sending visitor data to an ad platform for retargeting is 'sharing' even if no money changes hands. If you run pixel-based advertising, choose the advertising answer in the cookies question and the yes answer on sale or sharing, and provide the opt-out.
Publishing and maintaining the policy
Link the policy from the footer of every page, from account signup, and from any form that collects personal information, and give it a dated effective date. Update it whenever your stack changes: a new analytics tool, a new email provider, or a new ad channel each changes the third-party disclosure. Sites that also sell need terms and conditions alongside the privacy policy, and software distributed to users typically adds an end user license agreement.
The policy is a promise
Courts and the FTC treat a published policy as a binding representation. Overpromising ('we never share your data with anyone') is more dangerous than accurate modesty, so describe what you really do, including the routine service providers every business uses.
Frequently asked questions
Is a privacy policy legally required for a small website?
If the site collects any personal information, even just a contact form or newsletter signup, and can be visited by California residents, CalOPPA requires a policy. App stores, payment processors, and ad networks require one contractually regardless of size, so in practice nearly every commercial site needs one.
Does this policy cover GDPR for European visitors?
This template is built for US law: state privacy statutes, COPPA, and FTC requirements. If you actively market to or process data of EU residents, GDPR adds requirements, such as a lawful basis for each processing purpose and data-subject rights, that deserve a dedicated review.
Can I copy a privacy policy from another website?
It is a bad idea twice over: the text is copyrighted, and a copied policy describes someone else's data practices. Since the FTC treats an inaccurate policy as a deceptive practice, a borrowed policy can be worse than none. Generate one that matches what you actually collect.
Where do I have to display the privacy policy?
CalOPPA requires it to be conspicuous: the standard practice is a footer link on every page, a link at account creation and checkout, and, for apps, a policy URL in the store listing and inside the app's settings.
How often should I update the policy?
Review it whenever you add a tool that touches user data and at least once a year. Update the effective date with each change, and for material changes, notify users through the site or by email before the new terms apply.
What is the difference between a privacy policy and terms and conditions?
The privacy policy discloses data practices and is required by law; terms and conditions are the contract governing use of the site, orders, disclaimers, and disputes, and are strongly recommended but generally optional. Most sites publish both, linked side by side in the footer.