Yes—if your website collects any personal information from visitors, you almost certainly need a privacy policy. No single U.S. federal statute requires every site to post one, but California’s disclosure law reaches nearly every commercial U.S. site, roughly 20 states now have their own consumer privacy statutes, and the European Union’s GDPR applies to any operator whose site is used by people in the EU. Between those overlapping rules, a website without a privacy policy is a website out of compliance.
What Counts as Collecting Personal Data
The legal trigger is broader than most site owners realize. “Personally identifiable information” covers more than names and email addresses. IP addresses, geolocation data, device identifiers, and information gathered by cookies or tracking pixels all qualify. If you run Google Analytics, embed a YouTube video, accept payments, or use a contact form, your site is collecting this kind of data.
The other thing to understand is jurisdiction. Most of these laws apply based on where your visitors live, not where your business is located. A small business in Iowa with a site accessible to California residents is subject to California law. A hobby blog with European readers falls under GDPR. Because you cannot control who visits, the safest working assumption is that you need a compliant privacy policy.
The Laws That Decide Whether You Need One
CalOPPA
The California Online Privacy Protection Act applies to any operator of a commercial website or online service that collects personally identifiable information from California residents.1California Legislative Information. California Business and Professions Code 22575 The statute only requires that the site be accessible to those residents, which is why it effectively covers any U.S.-facing site.2California Department of Justice. Making Your Privacy Practices Public
CalOPPA is specific about what the policy has to say: the categories of information you collect, the categories of third parties you share it with, the process for users to review or request changes, how you notify users of material changes, and the effective date. You also have to disclose how you respond to browser “do not track” signals and whether other parties collect information about your visitors’ activity across different websites.1California Legislative Information. California Business and Professions Code 22575
The CCPA and the Newer State Laws
California added a second, stronger layer with the California Consumer Privacy Act, as amended by the California Privacy Rights Act. The CCPA applies to for-profit businesses that meet any one of three thresholds: annual gross revenue over roughly $25 million (adjusted for inflation, about $26.6 million for 2025), processing data of 100,000 or more California consumers or households per year, or earning more than half of annual revenue from selling or sharing personal information.3State of California – Department of Justice. California Consumer Privacy Act Cross any of those lines and you owe consumers detailed notices and honor their rights to access, delete, and opt out of the sale of their personal information.
California is no longer alone. Roughly 20 states now have comprehensive consumer privacy laws in effect. Indiana, Kentucky, and Rhode Island all had new laws take effect on January 1, 2026, joining Virginia, Colorado, Connecticut, Texas, and others. These laws share a common shape: businesses have to disclose their data practices, honor consumer rights to access and delete, and obtain opt-in consent before processing sensitive information such as health data, biometrics, or precise geolocation.
Even businesses well under California’s revenue threshold are increasingly likely to be covered by their own state’s rules or the rules of a state where their customers live.
The GDPR
The EU’s General Data Protection Regulation applies to any website that offers goods or services to people in the EU or monitors the behavior of individuals in the EU, regardless of where the operator is based.4General Data Protection Regulation (GDPR). Art. 3 GDPR – Territorial Scope Running Google Analytics on a site EU residents visit counts as monitoring behavior. Selling products that ship to Europe counts as offering goods. The reach is intentionally broad, and many U.S. websites fall inside it without realizing it.5European Commission. Who Does the Data Protection Law Apply To?
GDPR requires a notice that goes further than most U.S. laws. It has to identify the legal basis for processing each category of data, name your data protection officer if you have one, explain retention periods, and describe users’ rights to access, correct, delete, and port their information. If you transfer data outside the EU, the policy has to explain what safeguards apply.
Industry-Specific Federal Rules
Some sites carry additional obligations on top of the general laws above.
The Children’s Online Privacy Protection Act imposes strict requirements on any site or online service directed at children under 13, or any operator that actually knows it is collecting data from a child. You must post a prominent, clearly labeled notice describing what information is collected, how it is used and disclosed, and your retention practices, and you must obtain verifiable parental consent before collecting anything.6eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule7Federal Trade Commission. Verifiable Parental Consent and the Children’s Online Privacy Rule COPPA reaches mixed-audience sites too: subject matter, animated characters, the age of models in imagery, and ad targeting are all factors the FTC weighs.
The Gramm-Leach-Bliley Act requires businesses that offer financial products or services—loans, investment advice, insurance—to explain their information-sharing practices and safeguard sensitive data.8Federal Trade Commission. Gramm-Leach-Bliley Act For customers who interact with you electronically, you can meet the notice requirement by posting the policy on your website, provided the customer acknowledges receiving it.9Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule Gramm-Leach-Bliley Act
HIPAA-covered entities—healthcare providers, health plans, and healthcare clearinghouses—must post a notice of privacy practices, and any covered entity whose website describes its services must prominently post that notice on the site.10eCFR. 45 CFR 164.520 – Notice of Privacy Practices for Protected Health Information The HIPAA notice has its own required format.
What Happens If You Don’t Post One
Under CalOPPA, an operator who fails to post a policy within 30 days of being notified of noncompliance is deemed in violation.1California Legislative Information. California Business and Professions Code 22575 Enforcement runs through California’s Unfair Competition Law, which allows civil penalties of up to $2,500 per violation. Each visitor interaction can count as a separate violation, so exposure adds up quickly on a high-traffic site.
The CCPA is steeper. The California Privacy Protection Agency can impose administrative fines of up to $2,500 per violation, or $7,500 for each intentional violation or violation involving data of consumers under 16.11California Legislative Information. California Civil Code 1798.155 Those figures adjust for inflation; the 2025 amounts were $2,663 and $7,988.12California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases Consumers also have a private right of action when data breaches result from a business’s failure to maintain reasonable security, with statutory damages of roughly $100 to $750 per consumer per incident.3State of California – Department of Justice. California Consumer Privacy Act
GDPR penalties are larger than anything on the U.S. side. Violations of processing principles, consent requirements, or data subjects’ rights can draw fines up to €20 million or 4% of worldwide annual turnover from the prior year, whichever is higher. A lower tier covering organizational obligations carries fines up to €10 million or 2% of global turnover.13General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines
The practical consequences can bite before any regulator ever calls. Apple’s App Store, Google AdSense, and major payment processors all require a compliant privacy policy as a condition of use. Missing one can get your app pulled, your ad account suspended, or your payment processing frozen, sometimes with little warning.
What Your Privacy Policy Has to Cover
The specifics vary by law, but a policy that satisfies CalOPPA, the CCPA, and the GDPR will cover most of what other statutes require. At a minimum:
- The categories of personal information you collect, from names and email addresses to IP addresses, cookies, and device identifiers.
- How you collect it, distinguishing what users provide directly from what is gathered automatically through analytics and tracking technologies.
- The business purpose behind each category—processing orders, improving the site, serving targeted ads, and so on.
- Whether you share or sell personal information and the categories of recipients.
- User rights to access, correct, delete, and port their data, plus the CCPA right to opt out of data sales.
- Retention periods and what determines when you delete data.
- How you will notify users when the policy changes.
- Contact information for privacy questions and requests.
- The effective date.
CalOPPA adds a requirement many owners miss: you must disclose how you respond to browser “do not track” signals and whether third parties collect information about visitors’ activity across different sites when they use yours.1California Legislative Information. California Business and Professions Code 22575 If you run third-party ad scripts or social plugins, the honest answer is probably yes, and the policy needs to say so.
A separate opt-out signal deserves attention. Global Privacy Control is a browser-level signal telling websites a visitor wants to opt out of having personal data sold or shared. California’s CCPA recognizes GPC as a valid opt-out mechanism, and more than a dozen states now require sites to honor it.14Global Privacy Control. Global Privacy Control – Take Control Of Your Privacy Indiana, Kentucky, and Rhode Island included GPC recognition in the laws that took effect in 2026. If your site sells or shares personal data, or uses it for targeted advertising, you should detect and respond to GPC signals, and your policy should explain how you handle them.
Where and How to Display It
Placement matters as much as content. CalOPPA defines “conspicuously post” with precision. You can put the full policy on your homepage, but the standard approach is to link to a separate page. That link has to appear on the homepage or the first significant page a visitor sees, and it has to either include the word “privacy,” use a contrasting color against the background, use larger or bolder type than surrounding text, or be set off by symbols that draw attention.2California Department of Justice. Making Your Privacy Practices Public The near-universal convention of a “Privacy Policy” link in the footer on every page meets this standard and is what regulators expect to see.
For simple sites, an online generator can produce a workable first draft. Templates give more control but require you to understand each provision. For businesses with complex data flows, multiple third-party integrations, or significant traffic, a custom policy drafted by an attorney is worth the cost. Boilerplate that does not accurately describe what your site actually does can be worse than no policy at all, because the policy itself creates enforceable promises. Once published, treat the document as living: any new analytics tool, payment processor, email program, or change in how you handle user data should trigger an update. The gap between what your policy says and what your site does is where enforcement actions come from.