How to write a privacy policy that's actually true

Step 1: list what your site actually collects

Most privacy policies go wrong before anyone writes them, because nobody checked what the site does. A policy copied from a template describes someone else's business. A policy that says "we never share your data" while an ad pixel sends visits to Facebook is the exact pattern the FTC has taken companies to task over (more on that below).

Go through your site and note every place personal information comes in or goes out:

Tracking, cookies & privacy explains what each of these gathers in more detail. If you're a Chykalophia client, ask us for a list of the scripts and integrations on your site. It's the fastest way to get this step right.

Step 2: know which rules apply to you

The contents a policy needs depend on where your visitors are and what you do. These are the rules most of our clients run into.

California (CalOPPA): almost every site with California customers

California's Online Privacy Protection Act applies to a commercial website that collects personally identifiable information about California consumers. "Consumers" here means people who seek or buy goods or services for personal, family or household purposes, so a purely business-to-business site may fall outside it. The statute sets no size or revenue threshold, and it's written around where your visitors live, not where your business is. "Personally identifiable information" includes a first and last name, a physical address, an email address or a phone number, so a plain contact form is enough.

The law says the policy must:

• list the categories of personal information you collect, and the categories of third parties you may share it with;
• describe how people can review and request changes to their information, if you offer a way to do that;
• explain how you tell people about material changes to the policy;
• show its effective date;
• say how you respond to "Do Not Track" signals from browsers, if you track people across other sites (you can meet this with a clear link to a description of what you do);
• say whether other parties may collect information about people's activity over time and across different websites when they use yours. Ad and analytics pixels are the usual reason the answer is yes.

Two more points from the statute matter. First, the posting rule is only broken if you still haven't posted a policy 30 days after being notified. Don't treat that as a grace period. A separate section makes it a violation to fail to comply knowingly and wilfully, or negligently and materially, and that includes not following your own posted policy. Second, the site owner is responsible, not the agency or host that runs the site for them.

Delaware and Nevada

Delaware's online privacy law (6 Del. C. § 1205C) is close to a copy of California's, and broader in one way: it covers any individual who uses your site, not only consumers. Any commercial site or app collecting personal information from Delaware residents must make its policy conspicuously available, with much the same contents, and must follow it.

Nevada (NRS 603A.340) requires a similar notice. It has a small-business exception, but only for operators located in Nevada that earn most of their revenue offline and have fewer than 20,000 unique visitors a year. A small business elsewhere doesn't get it. Nevada also requires every operator to set up a designated address (an email, toll-free number or web page) where consumers can ask you not to sell their information, so ask a lawyer how Nevada's rules apply to you.

Larger businesses: CCPA and the other state privacy laws

California's CCPA applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above $26,625,000 (the 2025 inflation-adjusted figure, which the state updates every two years), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half their revenue from selling or sharing it. CCPA & CPRA basics covers who's in scope.

If it applies, your policy needs more: a description of people's California rights, two or more ways to submit requests (a business that operates only online and has a direct relationship with its customers may just provide an email address), the categories of information collected, their sources and purposes, who receives them, and whether you sell or share them. It must be updated at least every 12 months. Separately, at or before the point you collect information, you must tell people what you're collecting, why, and how long you'll keep each category; California's regulations let you do this by linking each form to the relevant section of your policy. If you haven't sold or shared personal information in the past 12 months, the policy has to say so prominently. If a covered business sells or shares personal information (ad pixels often count), California's regulations require it to treat browser opt-out signals such as Global Privacy Control as a valid opt-out request. California's privacy agency cited a failure to do this in its 2025 fine against Tractor Supply. Our cookie consent guide explains how opt-outs work on your site.

California isn't alone. Congress's research service counted at least 23 states with comprehensive consumer privacy laws by July 2026. Most apply only above a set number of consumers. That's typically 100,000, but some newer laws start lower: Delaware's is 35,000, falling to 10,000 on 1 January 2027. Many also have a lower number for businesses that earn a set share of their revenue from selling data, and some exempt small businesses altogether. Check each state where you have a meaningful number of customers.

Customers in the EU or UK: GDPR

If you offer goods or services to people in the EU, or monitor their behaviour there, the GDPR can apply to you even as a US business (GDPR basics explains when). GDPR's list is the most detailed. When you collect information from someone, you have to tell them at that moment:

• who you are and how to contact you;
• if you're based outside the EU or UK, your EU or UK representative's contact details. GDPR generally requires a business outside the EU (and UK GDPR, one outside the UK) to appoint one, unless its processing is only occasional, is unlikely to put people's rights at risk, and doesn't involve large-scale use of sensitive data such as health information or criminal records;
• your data protection officer's contact details, if you have one;
• why you're using their data, and your legal basis for doing so (consent, a contract, a legitimate interest and so on);
• who receives it;
• whether it goes outside the EU or UK, and on what basis;
• how long you keep it, or how you decide;
• their rights: access, correction, deletion, restriction, objection and portability;
• that they can withdraw consent at any time, where you rely on consent;
• that they can complain to a data protection regulator;
• whether they have to give you the data, and what happens if they don't;
• whether you make automated decisions about them, including profiling.

It also has to be concise, easy to find and written in clear, plain language. The UK regulator (the ICO) adds that you must review it regularly and tell people about any new use of their data before you start.

Children under 13: COPPA

If your site is aimed at children under 13, or you know you're collecting information from them, the federal COPPA Rule applies, with its own notice and parental-consent requirements. A general-audience site isn't treated as child-directed just because a child might visit. If kids are part of your audience, this is a job for a lawyer.

Health and financial businesses

Healthcare providers covered by HIPAA need a Notice of Privacy Practices, which is a separate document from a website privacy policy. If their website gives information about their customer services or benefits, the notice must be posted prominently there (HIPAA basics for websites). Financial institutions have their own privacy-notice rules under the Gramm-Leach-Bliley Act.

Step 3: write it, section by section

Put the rules above together and you get a structure that covers most small-business sites. Write each section in plain language, using what you found in Step 1.

Step 4: put it where people (and the law) expect it

• Link it from your homepage, normally in the footer, and include the word "privacy" in the link text. CalOPPA lists a homepage link containing "privacy" as one way to "conspicuously post" a policy, and California's CCPA regulations require one for businesses they cover.
• Link it from every form that collects personal information, next to the submit button. CCPA and GDPR both expect people to be told at or before the point of collection.
• Make it a normal web page, not a PDF or an image. A page is easier to read on a phone and easier to keep up to date. Covered businesses must also make it printable under California's CCPA regulations.
• Show the effective date at the top.

Using a generator

A policy generator asks you questions about your business and site, then writes a policy from its templates; several say lawyers draft or review them. For most small businesses it's the fastest way to a solid first draft, and the better ones keep the wording current as laws change. They're software, not law firms: Termly and Termageddon say explicitly that they aren't law firms, and TermsFeed and Shopify say their documents aren't legal advice.

These are the well-known options, compared on what each vendor says about its own product.

Prices change often, so check each vendor's pricing page. Ratings move too; the figures above are what Trustpilot showed when we checked.

How to choose

• If laws keep changing around you (you sell nationally or into the EU), pick one that updates your policy automatically: iubenda, Termageddon, Enzuzo, a paid Termly plan, or GetTerms' Business plan. A free, one-off policy is out of date the first time a relevant law changes.
• If you also need a cookie banner, getting it from the same vendor keeps the banner, the cookie list and the policy in step. Cookie consent law explains what the banner has to do, which matters more than who makes it.
• If you only need something simple to start with, a free tier is a reasonable first draft. Read the limits: some free plans don't update, some add the vendor's branding or a credit link.
• If you're on Shopify, the store admin can generate privacy, refund, shipping and terms templates and links them in your checkout footer. Shopify reminds you that you're responsible for following whatever you publish.

What a generator can't do for you

A generator only knows what you tell it. It doesn't know about the pixel your marketing contractor added last spring, or the CRM that copies every form entry. That's why Step 1 comes first: answer the generator's questions from your list, not from memory. Then read the result line by line and delete anything that isn't true for your business.

Step 5: keep it true

A privacy policy goes stale the day someone adds a new tool. These are the moments to reopen it:

• You add or remove a tool that touches visitor data: a new pixel, a chat widget, a CRM, a booking system, a review app. Our GDPR guide flags this as a common gap.
• You start selling somewhere new, such as a new state or the EU.
• You change how you use data, for example sending customer lists to an ad platform for targeting.
• Once a year at minimum. The CCPA requires covered businesses to update theirs at least every 12 months, and it's a sensible habit for everyone.

Keep it findable, too. In 2019 France's privacy regulator fined Google €50 million, partly because key information was spread across several documents. One detail, how long data was kept, was reachable only through a link on the sixty-eighth page of a separate document, according to the court's ruling. France's highest administrative court upheld the fine in 2020. Having the right words somewhere isn't enough; people have to be able to find them.

Two writing mistakes that cost others

Why your website needs legal pages covers the enforcement cases in more detail. Two of them are worth knowing before you write a line:

• Promising something your tools contradict. In 2023 the FTC alleged that GoodRx promised it would never share personal health information with advertisers, then shared it with Facebook, Google and Criteo. The proposed order would ban GoodRx from sharing health data for advertising, and GoodRx agreed to a $1.5 million civil penalty under the FTC's Health Breach Notification Rule for failing to report those disclosures. The same year BetterHelp agreed to pay $7.8 million to consumers over similar allegations about promises not to share health data. "We never share your data" is an easy sentence to write and a hard one to keep once ad pixels are on the site. (FTC on GoodRx, FTC on BetterHelp)
• Claiming a certification you don't have. In 2019 five companies settled FTC allegations that their websites falsely claimed to be certified under the EU-US Privacy Shield framework: four had applied but never finished certifying, and one had let its certification lapse. If a template, an old draft or a past policy claims a certification or standard you don't currently hold, delete it. (FTC)

Common mistakes

• Copying another site's policy. It describes their tools, their data flows and their business, not yours.
• Leaving template claims you can't stand behindCertifications, "we never share", "we don't use cookies".
• Forgetting the pixels. Analytics and ad tags are third parties collecting data across sites, and most laws above expect you to say so.
• No date, or a date from years ago.
• Hiding it. A policy that's only reachable from a sitemap or a checkout page isn't conspicuous.
• Never updating it after the site changes.

Common questions

Related guides

• ComplianceWhy your website needs legal pagesWhich legal pages your website actually needs (privacy policy, terms of service, refund policy, cookie notice, disclaimers), which are required by law, which by the platforms you use, and the real cases that show why.
• ComplianceHow to write terms of serviceWhat website terms of service are for, what to put in them, the store and subscription rules that sit alongside them, and how to present them so a court will treat them as agreed.
• ComplianceGDPR basics for businessesWhat the EU's General Data Protection Regulation means for your website, even if your business is based outside Europe.
• ComplianceCCPA & CPRA basics for businesses serving CaliforniaWhat California's consumer privacy law means for your website, who it applies to, and the practical steps we take to help you align with it.
• ComplianceCookie consent law: when & howWhen your website needs a cookie consent banner, what it must include, and how we set one up to follow GDPR and CCPA rules.
• Analytics & TrackingTracking, cookies & privacyA plain-English guide to how website tracking works, what cookies do, what privacy laws require, and how Chykalophia sets up tracking in a compliant way.
• Keeping your accounts & website safeData privacy basics for your businessA plain-English introduction to data privacy: what data your business likely holds, your responsibilities, and how to handle it well.

Learn more

• California Attorney General: privacy enforcement actionsoag.ca.gov
• California Privacy Protection Agency: CCPA regulationscppa.ca.gov
• EUR-Lex: the General Data Protection Regulation (Articles 12 to 14 cover what you must tell people)eur-lex.europa.eu
• UK Information Commissioner's Office: the right to be informedico.org.uk
• FTC: privacy and security enforcementftc.gov