What should a small business privacy policy cover?

The short version

• Start from a list of what your site collects and which outside tools load on it.
• Cover who you are, what you collect, why, who gets it, how long you keep it, people’s choices, and how to reach you.
• Write it in plain words. Short and true beats long and copied.
• Link it from every page footer and next to every form.
• Review it whenever you add or remove a tool, and at least once a year.

This isn’t legal advice. A state law like the CCPA can add required sections, and so can EU or UK rules if you offer goods or services to people there or track their behavior; a visit alone doesn’t usually bring a US business under them (GDPR Article 3). Have a lawyer check it.

What sections does the policy need?

Regulators on both sides of the Atlantic ask for much the same core. The UK ICO’s checklist of privacy information and the California Attorney General’s guide to privacy policies overlap on most of these.

Do Not Track, for California visitors

CalOPPA also asks how your site responds to a browser’s Do Not Track signal. It asks whether other companies can track visitors over time and across sites. The California guide suggests a clearly labelled section rather than a link elsewhere. “Our site does not respond to Do Not Track signals” is an honest answer if it’s true.

Extra sections when bigger laws apply

• CCPA (California): if it applies, the Attorney General’s CCPA page lists six rights. People can know, delete, correct, opt out of sale or sharing, limit sensitive data, and not be treated worse for asking. Your policy must explain them and how to use them.
• UK and EU: the ICO list adds your legal basis for each purpose and any transfers abroad. It also adds the right to complain to the regulator, and any automated decisions.

How do I write it without copying someone else’s?

1. List your tools. Open the site and write down every form, analytics tool, ad pixel, embed and plugin that handles visitor data. Our guide to vendors and processors helps.
2. Trace each form. Note where entries go: the website, inboxes, a CRM. See where form entries should be stored.
3. Fill in the table above with your own answers.
4. Use WordPress’s helper if you have it. In Settings, then Privacy, select Create New Page or choose an existing page and select Use This Page. WordPress’s documentation notes the page includes suggestions, but it’s “your responsibility” to make the content accurate and current.
5. Link it from the footer of every page, and add a short line by each form, such as “We’ll only use this to reply. See our privacy policy.”
6. Put a reminder in your calendar to review it every year.

Why does an accurate policy matter?

A privacy policy is a public promise. The FTC’s consumer privacy guidance tells businesses to reread their policy and make sure they honor what it promises. A policy that says “we never share your data” while a Facebook pixel sends page views to Meta is a problem.

Your tools ask for it too. The Google Analytics terms require a privacy policy that gives notice of your use of cookies and discloses that you use Google Analytics.

What are the common mistakes?

• Promising “we never share your information.” Almost every site shares something with its host, email provider or analytics tool.
• Naming tools you removed, or missing ones you added. A new booking widget or chat bubble needs a line.
• Legal filler with no real answers. Pages of text that never say what you collect.
• Hiding it. A policy that’s only linked from one page, or not near the forms.
• No date. Readers and regulators can’t tell if it’s current.
• A policy from a generator you never edited. Generators ask questions for a reason. Answer them for your business.

What if a policy generator or plugin doesn’t fit?

• Your site does something unusual, like health questions, children’s sign-ups or selling data. That’s lawyer territory.
• The generated text claims rights or laws that don’t apply. Remove what’s untrue, but ask a lawyer before removing rights sections.
• You can’t tell what your site loads. Ask your web company for the list before you write anything.

How much does it cost, and how long does it take?

The WordPress helper is free and built in. How long a first draft takes depends on how many forms, tools and data flows your site has, so start with the list of tools. Policy generators range from free to paid subscriptions, and law firm drafting varies, so ask for a quote.

How does E-3 handle this?

We don’t write legal policies. As part of website care, we can give you an accurate list of the forms, tools and embeds on your site. We can show where form data goes, so whoever writes your policy works from facts. We can also add the policy link to your footer and forms. You decide which changes to make.

Related questions

• Which vendors handle my customers’ data?
• Do I need cookie consent on my website?
• How long should I keep form submissions?
• Which US state privacy laws apply to a small business?
• Back to the complete privacy and cookies guide

Sources

1. What privacy information should we provide? (ICO)
2. Attorney General issues guide on privacy policies and Do Not Track disclosures (California Attorney General)
3. Consumer privacy (FTC business guidance)
4. Google Analytics terms of service (Google Marketing Platform)
5. Settings Privacy screen (WordPress documentation)
6. California Consumer Privacy Act (CCPA) (California Attorney General)