Does your website legally need a privacy policy? (And what it does — and doesn't — do)

There's a strange gap in how site owners think about privacy policies. On one hand, almost everyone senses they're supposed to have one — it's the reflexive footer link nobody reads. On the other, very few can say which law actually requires it, when it kicks in, or what it does beyond sitting there. That gap is where two opposite mistakes live: some people skip the policy assuming a small site is exempt, and others paste in a generic template assuming that "having a privacy policy" is the finish line. Both are wrong, and the second one is the more expensive.

This guide answers the question properly. First, whether you actually need one — with the specific laws and the real trigger. Then the part most articles skip: what a privacy policy actually does for you, what it doesn't, and why an inaccurate policy can be worse than not having one at all.

The real trigger: do you collect personal data?

Forget the size of your business for a moment — that's not the primary test. The question that determines whether you need a privacy policy is simpler: does your website collect personal information? And the bar for "collect" is far lower than most people assume. You're collecting personal data if your site does any of these:

Notice how low that bar is. A one-page brochure site with Google Analytics and a contact form is collecting personal data — an IP address is personal data under GDPR, and a name and email obviously are. This is why "it's just a small site" almost never gets you out of needing a policy. The obligation follows the data, not your revenue.

Which laws actually require it

Here's a fact that surprises people: there is no single US federal law that says every website must have a privacy policy. Instead, the requirement comes from a patchwork of state and international laws — and because the internet doesn't respect borders, several of them apply to you at once. These are the ones that matter most:

You don't get to pick which applies. If you serve customers across states or countries — and online, you almost always do — your privacy program has to account for the strictest requirement that reaches you. In practice, that means a modern website is answering to several of these at once, which is exactly why "do I need a privacy policy" almost always resolves to "yes."

One distinction worth understanding: opt-in vs. opt-out

The laws don't just differ in whether they apply — they differ in a way that changes what your policy has to say. GDPR uses an opt-in model: for most non-essential processing, you need a person's affirmative consent before you collect or share their data. Most US state laws flip that: they use an opt-out model, where you can process data by default, but residents have the right to tell you to stop selling or sharing it — which is why the CCPA requires a "Do Not Sell or Share My Personal Information" mechanism, and why browser signals like Global Privacy Control increasingly matter. The practical upshot for your policy is that it has to describe the right model for the right audience: what you disclose to an EU visitor (and when you ask for consent) isn't identical to what a California resident is entitled to. A policy that only accounts for one model is incomplete for the other.

The two non-legal reasons you also need one

Even setting the law aside, two practical forces make a privacy policy non-optional. First, the platforms you depend on require it: Google (for Analytics and Ads), Apple's App Store, and Facebook all require a privacy policy to use their services — no policy, no access. Second, it's a matter of basic trust: a visitor deciding whether to hand over an email or a credit card looks for the policy as a signal that you're a real, accountable business. So the requirement is legal, contractual, and reputational all at once.

What a privacy policy actually does — and doesn't

This is the part that matters most, and the part almost every "do you need a privacy policy" article skips. Because once you accept that you need one, it's dangerously easy to assume that having one is the goal — paste in a template, link it in the footer, done. That assumption is the costly mistake, and understanding why is the whole point.

A privacy policy is a disclosure. Its job is to accurately describe what your website does with personal data: what you collect, why, who you share it with, and how people can exercise their rights. That's it. It's a statement of fact about your practices.

Which leads to the single most important thing to understand about privacy policies, and the reason "just paste a template" is genuinely risky:

An inaccurate policy can be worse than no policy

A generic, copy-pasted privacy policy describes a generic website — not yours. It might list data practices you don't have, or, far more dangerously, omit ones you do. And here's the part that should stop you: regulators have fined companies for privacy policies that described data practices the company did not actually follow — in both directions, whether the policy overstated or understated what really happened.

This is why the accurate version of the advice isn't "get a privacy policy." It's "get a privacy policy that truthfully describes your actual site — and then make sure your site actually behaves the way the policy says." Those are two different jobs, and most tools only pretend to do the first.

How to get a policy that's actually accurate

If the danger is a mismatch between your policy and your real site, the fix is to build the policy from your real site rather than from a blank template. That means two things working together:

• Know what your site actually does. Before you can disclose your trackers, you have to know what they are — and most owners genuinely don't, because tools get added through tag managers, plugins, and marketing apps over time. A scan of your site shows you what's really loading.
• Build the policy from that. A generator that starts from your real scan data produces a policy describing the trackers you actually run — not a generic list — so the disclosure is true from day one.

And because your site changes — new apps, new pixels, new tags — accuracy isn't a one-time achievement. The policy that was true in January quietly stops being true by June unless something keeps it current. That's the difference between a static template and a policy tied to what your site is genuinely doing.

Common mistakes to avoid

Beyond the template trap, a few specific errors show up again and again in enforcement actions and audits:

• Overpromising on deletion. Saying data "will be deleted upon request" without accounting for backups, legal retention, or third-party copies is a promise you may not be able to keep — which is itself a deceptive practice.
• Burying the opt-out. The CCPA and GDPR both require that rights and opt-out mechanisms be easy to find. Hiding them several clicks deep has been cited in enforcement.
• Missing data sources. Policies often describe website collection but forget analytics, embedded tools, mobile apps, or data from third parties — leaving the disclosure incomplete.
• Never updating it. The CCPA expects a privacy policy to be reviewed at least every 12 months; GDPR expects it to be accurate at all times. A policy you wrote once and forgot drifts out of truth as your site evolves.

Disclaimer: This article is general information, not legal advice, and does not create an attorney–client relationship. Privacy laws change frequently and vary by state and country; whether and how they apply to your specific website depends on your circumstances. ConsentPixel — Privacy · Verified is not a law firm, and generating a privacy policy does not by itself make a website compliant with any law. Consult qualified counsel for advice specific to your situation.