What a privacy policy on a small business website needs.

The short answer

A privacy policy, also called a privacy notice, is a page that tells visitors what personal data your business collects, why, who receives it, how long you keep it and what rights they have. If your website has a contact form, a booking tool, a chat window, a newsletter sign-up or analytics, it collects personal data, and you need one.

Two things make it a requirement for most small businesses. The first is the law where your customers are: the GDPR in the EU, the UK GDPR in the UK and, in the US, state laws, of which California's CalOPPA reaches furthest. The second is the terms of the tools you use. Google Analytics requires a privacy policy, and the texting industry's rules expect one from any business that sends texts.

A site with no forms, no analytics, no cookies and no embedded tools may collect nothing but the host's server logs. Even those hold IP addresses, which count as personal data under the GDPR, so a short notice is still the safe choice in Europe. For everyone else, the real question is what the policy must say, and that depends on where you and your customers are.

The US: CalOPPA, and when it applies

No single federal law requires every website to have a privacy policy. California's Online Privacy Protection Act, CalOPPA, comes close in practice. It applies to the operator of any commercial website or online service that collects personally identifiable information from consumers who live in California. Your business does not have to be in California: if Californians use your contact form, assume it applies.

Personally identifiable information here means details such as a first and last name, a postal address, an email address, a phone number, a Social Security number or any other identifier that lets someone contact a specific person. CalOPPA protects consumers, meaning people buying for personal or household purposes, so a site that deals only with other businesses may fall outside it. Ask an adviser before you rely on that.

The policy must be posted conspicuously, for example through a link containing the word privacy on the home page, and it must:

• List the categories of personal information you collect and the categories of third parties you share it with.
• Describe how a visitor can review and ask to change their information, if you offer that.
• Explain how you tell visitors about material changes to the policy.
• Give its effective date.
• Say how the site responds to browser Do Not Track signals, if you collect information about people's activity across other sites over time.
• Say whether other parties may collect that kind of information when people use your site.

A business breaks CalOPPA if it fails to post a policy within 30 days of being told it is missing, or if it fails to follow its own policy, knowingly and wilfully or negligently and materially. That second part matters: a policy you do not follow is worse than a short one you do.

Larger businesses face more. California's CCPA and the privacy laws of other states apply above set size and data thresholds, and the FTC has brought cases against companies whose privacy promises did not match what they did. If your business may be near those thresholds, ask an adviser.

The EU and the UK: Article 13 of the GDPR

Under the GDPR, when you collect personal data from someone, you must give them certain information at that moment. Article 13 lists it:

• Your business's name and contact details, and your EU representative if you need one.
• Your data protection officer's contact details, if you have one.
• The purposes of each use and its lawful basis.
• The legitimate interests you rely on, where that is the basis.
• Who receives the data, by name or by category.
• Any transfer outside the EU, and the safeguard used, such as the EU-US Data Privacy Framework.
• How long you keep it, or how you decide.
• The visitor's rights to access, correction, deletion, restriction, objection and portability.
• The right to withdraw consent, where consent is the basis.
• The right to complain to a data protection authority.
• Whether people have to give the data, and what happens if they do not.
• Any automated decision-making about them, with meaningful information about how it works.

Article 12 adds that it must be concise, clear and in plain language. The usual way to meet both is a privacy notice page linked from the footer of every page, plus a short line next to each form's button.

The UK GDPR uses the same list. If you are in the UK, the ICO is the authority to name.

The US and EU rules side by side

If you have customers in both, one policy can cover both, written to the longer list. The differences that change what you write:

• CalOPPA is triggered by personally identifiable information such as a name or an email address. The GDPR is triggered by any personal data, including the IP addresses in server logs.
• CalOPPA does not ask for a lawful basis. The GDPR asks for the basis of each use.
• CalOPPA does not ask how long you keep data. The GDPR does, for each kind of record.
• CalOPPA asks how visitors can review and change their data only if you offer that. The GDPR lists rights every business must honour.
• CalOPPA asks how you respond to Do Not Track. In the EU, the cookie rules ask for consent before non-essential cookies are set.

Write the GDPR version first, then add the CalOPPA items it does not already cover: the Do Not Track answer, the effective date and how you announce changes.

What your tools expect it to say

Several tools make a privacy policy a condition of use, and some say what it must contain:

• The Google Analytics terms require a posted privacy policy that gives notice of your use of cookies and discloses your use of Google Analytics and how it collects and processes data.
• Google's EU user consent policy requires you to name each party that collects or uses visitors' data through Google's products and to explain how, for visitors in the EEA, the UK and Switzerland.
• If you use an advertising pixel such as Meta's, name it and say what it sends. Our guide to tracking leads from Meta ads covers the consent side.
• If your site has a chat window, such as an AI chatbot, say what happens to conversations and how long they are kept, and link the policy from the chat window.

Name only the tools you really use. A policy that lists five analytics and advertising tools on a site that runs one is as wrong as a policy that lists none.

The texting section carriers look for

If your business texts customers in the US from an ordinary 10-digit business number, for booking reminders or replies to missed calls, that number has to be registered with the mobile carriers, a process called A2P 10DLC, and your privacy policy is part of what gets reviewed.

The US wireless industry's messaging principles, published by CTIA, say a business that texts consumers should have a privacy policy that is easy to find, linked from the place where people sign up, and that explains how it collects, uses and shares their information. They also say opt-in lists should never be rented, sold or shared. In your policy, that becomes a short texting section:

• What you text about, such as confirmations and reminders, and roughly how often.
• How to stop the messages and how to get help.
• That message and data rates may apply.
• One plain sentence, such as: "We never sell or share the mobile numbers and text consent we collect with other companies for their marketing."

Our guide to A2P 10DLC registration has the exact wording reviewers expect, and the text message consent rules cover when you may text at all. GGSites handles the US carrier registration as part of its missed-call text-back setup, listed on our prices page.

What generated policies get wrong

Free generators and templates save typing. These are the mistakes they leave behind:

• They list tools you do not use, such as advertising networks, heat maps or analytics you removed years ago, and miss the ones you do use, such as your booking software or chat tool.
• They make promises you do not keep, such as "we never share your data" on a site whose form sends every enquiry through a third-party tool.
• They give no retention periods, or one period for everything.
• They name the wrong law, or the wrong country's authority.
• They carry the generator's own company name, or a placeholder nobody replaced.
• They describe children's data, payments and account logins on a site that has none of them, and say nothing about the chat window it does have.
• Nobody updates them when the site changes.

A wrong policy is not a harmless formality. Under CalOPPA, failing to follow your own posted policy can be a breach in itself, and under the GDPR the notice is part of how you show that your processing is fair and transparent.

Use a template for structure if it helps, then rewrite every line from your own list of what the site collects. Our GDPR checklist shows how to make that list.

A structure that works for a small business

Organise the policy by where data comes in, rather than by legal headings. A visitor who has just used your booking form wants to find the part about booking. For a physiotherapy clinic with online booking, the sections might be:

• Who we are, and how to contact us about privacy.
• Booking an appointment: what the booking software collects, why and for how long.
• The contact form and email.
• The chat on our website.
• Text and email reminders.
• Analytics and cookies.
• Who else receives your data: the booking software, the email provider and the host.
• Transfers outside the UK or the EU, if any.
• How long we keep each kind of record.
• Your rights, how to use them and how to complain.
• Changes to this policy, with the date of the last update.

Our own privacy notice is organised this way, with a section each for project enquiries, the website assistant, visit counting, technical logs and cookies.

Health information needs extra care. A clinic should keep symptoms and medical history out of general forms and chats, and say in the policy where they are collected instead.

Sample wording for the parts people read

Plain sentences work better than legal phrases. For the contact form section of a small accountancy firm in Ireland, something like this covers what Article 13 asks:

"When you send our contact form, we receive your name, your email address, your phone number if you give it and your message. We use them to reply to you and, if you ask, to prepare a quote. Our legal basis is taking steps at your request before a contract. Our form tool and our email provider process the details for us. We delete enquiries that do not lead to work after six months. To see, correct or delete your details, email us at the address at the top of this page."

Use your own period and your own tools. For a US site that does not track visitors across other websites, the Do Not Track line CalOPPA asks for can be as short as this: "This site does not collect information about your activity on other websites, so browser Do Not Track signals change nothing here."

Where to link it, and how to keep it current

• A link with the word Privacy in the footer of every page, which also meets CalOPPA's rule for the home page.
• A short line next to each form's button, with a link: "We use your details to reply to you. See our privacy notice."
• A link in the chat window and in the cookie banner.
• A link from your booking page, if the booking tool hosts it on its own site.
• The date of the last update, at the top of the policy.

Review the policy whenever you add or remove a tool: a new booking system, a newsletter tool, an advertising pixel or an automation that copies enquiries into a CRM. Read it once a year even if nothing has changed, and have it read by someone who knows what the site really does today.