Does Your Website Need a Privacy Policy? (Almost Certainly Yes)

If your site collects any personal data — even just an analytics cookie or a contact form — you almost certainly need a privacy policy. Beyond the law, app stores, ad networks, and payment processors all require one before they'll work with you.

What counts as "collecting data"

More than people think. All of these trigger the requirement:

• Analytics (Google Analytics, Plausible, etc.)
• Cookies, including from embedded videos or social widgets
• Contact or signup forms
• Server logs that store IP addresses
• Third-party services that process user data on your behalf

What a privacy policy must cover

At minimum: what data you collect, why, how it's used, who it's shared with, how long you keep it, and how users can contact you. If you serve certain regions, you also need region-specific rights.

GDPR and CCPA

• GDPR (EU/EEA) grants rights to access, correct, delete, and port data, and to object to processing or withdraw consent. If you have EU visitors, include these.
• CCPA (California) grants rights to know what's collected, to request deletion, and to opt out of the sale of personal information.

Enable the section that matches your audience — and remember that "we don't sell data" is itself a statement worth making explicitly under CCPA.

Generate a starter

Don't copy a random policy that may include clauses you don't follow. The Privacy Policy Generator builds a policy from your actual setup — toggle cookies, analytics, third-party services, GDPR, and CCPA to match reality. It's a starting point, not legal advice, so have a professional review it. While you're at it, most sites also need a Terms of Service.