Privacy Policy Requirements: What the Law Actually Demands
A privacy policy is not optional for most online businesses. Multiple federal, state, and international laws require websites and apps that collect personal information to maintain a publicly accessible privacy policy. Understanding which laws apply to your business and what they require is essential for staying compliant.
Which Laws Require a Privacy Policy?
Several major privacy laws mandate that businesses publish a privacy policy. Depending on where your users are located, multiple laws may apply simultaneously.
California Consumer Privacy Act (CCPA/CPRA)
The CCPA applies to businesses that collect personal information from California residents and meet at least one of these thresholds:
- Annual gross revenue exceeding $25 million
- Buy, sell, or share the personal information of 100,000 or more consumers, households, or devices
- Derive 50% or more of annual revenue from selling or sharing personal information
The CCPA requires your privacy policy to disclose the categories of personal information collected, the purposes for collection, consumer rights, and how to exercise those rights.
General Data Protection Regulation (GDPR)
If you collect data from anyone in the European Union or European Economic Area, the GDPR applies regardless of where your business is located. The GDPR requires extensive disclosures about your data processing activities, legal basis for processing, data retention periods, and data subject rights.
CalOPPA (California Online Privacy Protection Act)
CalOPPA was one of the first laws in the United States to require a privacy policy. It applies to any website or app that collects personally identifiable information from California residents, regardless of the business's size or revenue.
Children's Online Privacy Protection Act (COPPA)
If your website or app is directed at children under 13 or you knowingly collect information from children, COPPA imposes strict requirements including obtaining verifiable parental consent.
State Privacy Laws
Several other states have enacted comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and others. Each has specific privacy policy requirements.
Even if your business is small and based outside California or the EU, you likely still need a privacy policy. If you use Google Analytics, run ads, collect email addresses, or accept payments online, you are collecting personal information that triggers disclosure requirements under one or more privacy laws.
What Your Privacy Policy Must Include
While specific requirements vary by law, most privacy regulations require the following disclosures.
1. What Information You Collect
List the categories of personal information your business collects. Be specific. Common categories include:
- Identifiers — Names, email addresses, phone numbers, IP addresses
- Financial information — Credit card numbers, billing addresses, purchase history
- Usage data — Pages visited, time spent on site, click patterns
- Device information — Browser type, operating system, device identifiers
- Location data — Geographic location based on IP address or GPS
- Cookies and tracking data — Information collected through cookies, pixels, and similar technologies
2. How You Collect Information
Explain the methods you use to gather data:
- Information users provide directly (forms, account registration)
- Information collected automatically (cookies, analytics, server logs)
- Information received from third parties (data brokers, social media platforms, advertising partners)
3. Why You Collect Information
State the purposes for collecting each category of data. Common purposes include:
- Providing and improving your products or services
- Processing transactions and sending related communications
- Personalizing user experience
- Sending marketing communications
- Analyzing usage patterns and trends
- Complying with legal obligations
- Preventing fraud and ensuring security
4. How You Share Information
Disclose the categories of third parties with whom you share personal information and the purposes for sharing. This includes:
- Service providers (payment processors, hosting providers, email services)
- Advertising partners (ad networks, analytics providers)
- Business partners (affiliates, joint ventures)
- Legal and regulatory authorities (when required by law)
5. User Rights
Depending on applicable laws, your privacy policy must inform users of their rights, which may include:
- Right to know — Request disclosure of what information has been collected
- Right to delete — Request deletion of their personal information
- Right to opt out — Opt out of the sale or sharing of personal information
- Right to correct — Request correction of inaccurate information
- Right to portability — Receive their data in a portable format
- Right to non-discrimination — Not be penalized for exercising privacy rights
6. Data Security Measures
While you do not need to reveal the technical details of your security infrastructure, you should describe the general measures you take to protect personal information. This might include encryption, access controls, regular security assessments, and employee training.
7. Data Retention Periods
Under the GDPR and several state laws, you must disclose how long you retain personal information or the criteria used to determine retention periods.
8. Contact Information
Provide a way for users to contact you with privacy-related questions or requests. Include at minimum an email address, and consider providing a mailing address and phone number.
9. Effective Date and Update History
Include the date your privacy policy was last updated. Some laws require you to note the effective date and describe how users will be notified of changes.
Formatting and Accessibility Requirements
Beyond the substantive requirements, several laws impose formatting and accessibility standards.
Easy to Find
Your privacy policy must be prominently linked from your homepage. The standard practice is to include a "Privacy Policy" link in your website footer. For mobile apps, the policy should be accessible from within the app settings and linked in your app store listing.
Easy to Read
Write your privacy policy in clear, plain language. Avoid legal jargon where possible. The GDPR specifically requires that privacy disclosures be provided in a "concise, transparent, intelligible and easily accessible form, using clear and plain language."
Available Before Data Collection
Users should be able to review your privacy policy before you collect their personal information. This means the policy should be accessible before account creation, before checkout, and before form submission.
Organize your privacy policy with clear headings, short paragraphs, and a table of contents for longer documents. A well-organized privacy policy is easier for users to navigate and demonstrates good faith compliance to regulators.
Common Compliance Mistakes
Failing to Update After Changes
Your privacy policy must reflect your current data practices. If you add a new analytics tool, start using a new ad network, or change how you handle customer data, update your privacy policy accordingly.
Being Too Vague
Statements like "we may collect certain information" do not satisfy legal requirements. Be specific about what you collect and why.
Ignoring Third-Party Tools
Every third-party tool you use on your website — analytics, chat widgets, advertising pixels, payment processors — collects data on your behalf. Your privacy policy must disclose these third-party data collection activities.
Not Addressing All Applicable Laws
If you have users in multiple jurisdictions, your privacy policy should address the requirements of each applicable law. Many businesses create separate sections for GDPR, CCPA, and other specific regulations.
Keeping Your Privacy Policy Current
Privacy law is evolving rapidly. New state laws are being enacted regularly, and existing regulations are being updated and clarified through enforcement actions and regulatory guidance. Establish a process for reviewing your privacy policy at least quarterly and whenever you make changes to your data collection or processing practices.
A comprehensive, accurate, and up-to-date privacy policy is not just a legal requirement — it builds trust with your users and demonstrates your commitment to responsible data handling.