What to Include in a Website Privacy Policy
The sections most privacy policies need, how to work out what your site really collects, and the mistakes to avoid.
A privacy policy explains what personal information your website handles and why. Many laws require one, and services such as advertising networks and app stores ask for one too. This guide is general information rather than legal advice: the rules depend on where you and your visitors are.
Start by finding out what you actually collect
The biggest mistake is describing what you assume happens. Before writing anything, list every way data enters your site:
- Forms: contact, sign-up, checkout and comments.
- Third-party scripts: analytics, advertising, chat widgets, embedded videos and fonts.
- Plugins and apps, which often collect data you never see.
- Server logs kept by your hosting company.
Your browser's developer tools show which outside services a page contacts, which is a quick way to find things you had forgotten about.
The sections most policies need
- Who you are and how to reach you.
- What you collect, in plain language.
- Why you use it, and in some regions the legal basis for each purpose.
- Who receives it, such as payment, email and analytics providers.
- Cookies, or a link to a separate cookie policy.
- How long you keep it, using real periods if you can.
- People's rights, and how to use them.
- International transfers, if data leaves the country.
- Children, if your service could reach them.
- The date of the last update.
Mistakes to avoid
- Copying another site's policy. It describes their practices, not yours, and may infringe copyright.
- Promising too much. Saying "we never share your data" is a problem if you use a payment provider or analytics. Regulators can act on promises you do not keep.
- Letting it go stale. Update the policy when you add a new tool or plugin.
- Hiding it. Link to it from every page, usually in the footer, and from forms that collect data.
A generator is a starting point
A generator can turn your answers into a structured draft, but it cannot check that your answers are complete or that the draft meets the law where you operate. For anything beyond a simple site, have a lawyer review it.