Key takeaways
- Short answer: if your website has a contact form, analytics, a newsletter signup, or any social/ad pixel — yes, you need a privacy policy. That's nearly every business website.
- The law side: 20+ US states now have privacy laws, and Rhode Island's 2026 law requires a privacy policy from any commercial website serving even one Rhode Island resident.
- The practical side: Google Analytics, the Meta pixel, AdSense, and Stripe all require a privacy policy in their terms of service — this catches far more small businesses than any law does.
- A copy-pasted policy that's wrong about your site is worse than an honest short one. The fix costs ~$10/month with a generator or one afternoon of honest work.
Here's a question that comes up in almost every website build we do: somewhere around the footer design, someone asks, "Do we actually need a privacy policy?"
Usually they mean: is this a legal requirement for a business like mine, or is it just something big companies do?
Fair question. And the honest answer is a little annoying: probably yes — but not always for the reason you think. Most small business owners worry about the law. The law matters, but the thing that's most likely to actually force your hand is much more boring: the tools already running on your website.
This guide covers all three reasons — the law, your tools, and trust — plus what your policy needs to say, the three mistakes we see constantly, and the cheapest honest way to get one done this week.
One note before we start: we're web builders, not lawyers. This is practical guidance from a team that ships websites for a living, not legal advice. If you handle health data, financial data, or kids' data, talk to an actual privacy lawyer.
The 5-minute test: do you need one?
Answer these honestly. If any one of them is yes, you need a privacy policy:
- Does your site have a contact form, quote form, booking form, or newsletter signup? You're collecting names, emails, phone numbers.
- Do you run Google Analytics (or any analytics)? You're collecting IP addresses and behavior data — Google's own terms require you to disclose this.
- Do you have a Meta pixel, TikTok pixel, or LinkedIn Insight tag? You're sharing visitor data with ad platforms.
- Do you sell anything online? Payment processors touch names, addresses, and card details — even if the processor handles the card itself.
- Do you embed YouTube videos, Google Maps, or social feeds? Those embeds set cookies and phone home to their platforms.
- Do you have a cookie banner? The banner itself sets cookies. (Yes, really.)
Most business websites answer yes to at least two of these without thinking about it. If that's you, stop debating — you need the page. The rest of this article is about getting it right without overpaying or overthinking.
What the law actually says in 2026
Here's the landscape as it stands right now, in plain English.
The US: 20+ states and counting
The United States still has no federal privacy law. What it has instead is a patchwork: more than 20 states now have comprehensive consumer privacy laws, each with disclosure requirements that a well-written privacy policy satisfies. The heavyweight is California's CCPA/CPRA — $25M+ revenue, 100,000+ consumers' data, or 50%+ revenue from data sales. Most small businesses don't trip those thresholds.
But 2026 changed the math in ways that reach smaller businesses than before:
- Rhode Island (effective January 1, 2026): this is the sharp one. Rhode Island's law requires a privacy policy from any commercial website that does business with Rhode Island residents — not 100,000 residents, not 35,000. Even one. If you sell a product, a service, or a digital download to someone in Providence, you're in scope for the policy requirement. Penalties run up to $10,000 per violation.
- Indiana and Kentucky (effective January 1, 2026): these two follow the familiar Virginia model — 100,000 residents' data, or 25,000 plus half your revenue from data sales. Most small businesses won't hit those numbers, but the trend line is obvious.
- Connecticut (amended July 1, 2026): dropped its threshold from 100,000 to 35,000 consumers, and now covers any business that processes sensitive data or sells personal data regardless of volume.
- Texas: no revenue or volume threshold at all — it applies to any business doing business in Texas that isn't a federally-defined small business, and the attorney general has been actively enforcing since 2025.
The direction is one-way: every year the thresholds drop, the state count rises, and the "too small to matter" zone shrinks. Oklahoma's law takes effect January 2027, Alabama in May 2027. A policy you write this week gets more valuable every year, not less.
The international angle (in one paragraph)
If anyone in the EU visits your site, the GDPR technically applies to you regardless of where you're based — and it requires transparent privacy notices with legal bases, retention periods, and user rights. Enforcement against tiny US businesses is rare, but the GDPR is also why every serious analytics and ad platform bakes privacy disclosures into its terms. You don't need to become a GDPR expert; you need a policy that honestly describes your site, which is most of the battle anyway.
Forget the law for a second — your tools already require one
Here's the part most guides bury, and it's the part that actually applies to you. Even if no privacy law on earth covered your business, the services running on your website probably demand a privacy policy as a condition of using them:
- Google Analytics: Google's terms of service explicitly require a publicly accessible privacy policy disclosing your use of cookies for traffic data collection. No policy, no compliant Analytics.
- Meta pixel / Facebook ads: Meta's platform terms require it. Running retargeting ads without one is a terms violation, and ad account bans are not a fun way to learn this.
- Google AdSense: you flat-out cannot run AdSense without a compliant privacy policy.
- Stripe, PayPal, Square: payment processors require merchants to post privacy policies covering how customer data is handled at checkout.
- App stores: Apple and Google both require privacy disclosures before listing an app.
This is the quiet trap. A five-page brochure site with a contact form and Google Analytics is "collecting personal data" in the eyes of every platform it uses. The law might not knock on your door. A suspended ad account or a processor review will.
What actually goes in a privacy policy
A good policy isn't a wall of legalese — it's an honest inventory of what your website does with visitor information. Here are the sections that matter, in plain English:
| Section | What it means in plain English | Where most small sites get it |
|---|---|---|
| What you collect | Every category: names, emails, IP addresses, cookies, purchase history, device data | Contact forms, newsletter signups, analytics, server logs |
| How and why you collect it | The method (form, cookie, script) and the business reason for each type | "To respond to inquiries," "to improve the site," "to process orders" |
| Who else sees it | Every third party with access: Stripe, Mailchimp, Google Analytics, Meta, your host | This is the section most templates get wrong — see below |
| Cookies and tracking | What cookies you set, what each category does, how visitors can manage them | Analytics cookies, ad pixels, embedded videos |
| Visitor rights | How someone asks to see, correct, or delete their data — and how to contact you about it | A simple email address and a stated response time is enough for most small businesses |
| Data retention | How long you keep each category and what happens when the period ends | "Form submissions kept 2 years, then deleted" beats "as long as necessary" |
| Security | What you actually do: SSL, access controls, reputable processors | Don't claim military-grade anything. Describe reality. |
| Policy updates | How you'll notify people when the policy changes | "Last updated" date at the top + email notice for material changes |
Notice what's not on this list: clever disclaimers, ALL-CAPS warnings, and paragraphs copied from a Fortune 500 company's policy. Accuracy beats impressiveness. Regulators and courts compare your policy against your actual practices — a mismatch is itself a liability.
The 3 ways small businesses get this wrong
We've audited dozens of small business sites. The same three failures show up over and over:
1. The copy-paste mismatch
Someone grabs a template that says "we never share your data with third parties" — while the site runs Google Analytics, a Meta pixel, and Mailchimp. All three of those are third parties receiving visitor data. The policy is now a false statement published on your own website. This is worse than having no policy at all, because it documents the inaccuracy for anyone who cares to look.
Rule of thumb: if your policy doesn't mention every tool in your website's actual stack, it's fiction. List them by name.
2. The "we don't collect anything" fantasy
"We don't collect data — we just have a contact form." A contact form is data collection. So are server logs recording every visitor's IP address, which your hosting company keeps whether you look at them or not. Start from the assumption that your site collects data, then inventory it. The 5-minute test at the top of this article is the fastest way.
3. Set and forget
A policy written in 2022 that doesn't mention the TikTok pixel added in 2024, the email platform switched in 2025, or the chatbot added last month. Every new tool is a reason to reopen the document. Put a recurring calendar reminder — twice a year is enough for most small businesses — to re-read your policy against what's actually installed on the site.
Generator vs. template vs. lawyer: the honest breakdown
Three ways to get a policy, priced for reality:
| Option | Typical cost | Best for | The catch |
|---|---|---|---|
| Free template / generator | $0 | A brand-new site with a contact form and nothing else | Generic; won't name your actual tools; you must customize it honestly or it's the copy-paste trap |
| Paid generator (Termly, iubenda, Termageddon) | ~$5–$15/month per site (Termageddon ~$119/year; Termly from ~$10/month; iubenda from ~$5–$6/month) | Most small businesses — especially WordPress sites with plugins that change | Ongoing subscription; answer the questionnaire honestly or the output is still fiction |
| Privacy lawyer | $500–$2,000+ one-time for a small business policy | Health, finance, children's data, or anything with real regulatory exposure | Overkill for a brochure site; still needs updating when your stack changes |
Here's our blunt take from the builder's side: for most small business websites, a paid generator like Termageddon or iubenda plus 30 honest minutes answering its questions beats a lawyer-drafted policy that goes stale. The killer feature of the paid tools isn't the initial document — it's that they monitor law changes and update your policy automatically. With 20+ state laws and new ones landing every January, that auto-update is doing real work. (Termageddon is even listed as a vendor by the International Association of Privacy Professionals, for whatever that's worth to you.)
The free route is fine if your site is genuinely simple — but "free template, customized in 20 minutes with your actual tool list" is a very different thing from "free template, published as-is." The second one is the copy-paste trap.
And skip the lawyer unless your risk profile justifies it. A $1,500 policy for a plumber's brochure site is money burned; spend it on the thing lawyers can't give you — actually knowing what's installed on your site.
Your this-week action plan
Don't turn this into a project. Do it in one sitting:
- Inventory your stack (20 minutes). List everything on your site that touches visitor data: forms, analytics, pixels, embeds, email platform, payment processor, chatbot, booking tool. Check your installed WordPress plugins while you're at it — old ones collect things you've forgotten about.
- Pick your route (10 minutes). Simple brochure site? A free generator, carefully customized. Anything with e-commerce, ads, or a changing plugin stack? A paid generator at ~$10/month. Sensitive data? Call a lawyer.
- Answer honestly (30 minutes). Whatever tool you use, the output is only as true as your answers. Name every third party. State real retention periods. If you don't know how long you keep form submissions, decide now.
- Publish it in the footer (5 minutes). Link it from the footer of every page — that's where everyone looks, and some laws (Indiana's, for one) explicitly require the link to be clear and conspicuous. Also link it from your contact/quote forms and checkout pages.
- Set a twice-yearly reminder. Re-read the policy against your actual installed tools. New pixel? New email platform? Update the page the same day.
The bottom line
Most small business owners ask "do I need a privacy policy?" hoping the answer is no. We get it — it's one more thing. But between 20+ state laws (with Rhode Island now requiring one from essentially every commercial website), the terms of service of the tools already on your site, and the basic trust signal it sends to visitors, this is one of the cheapest credibility upgrades a website can get.
An honest one-page policy, kept current, costs less than a pizza a month. A missing one — or worse, a wrong one — costs you the argument the day it matters.
Not sure what your website is actually collecting right now? Our free site audit looks at your site the way a regulator, a competitor, and a customer would — and tells you what's actually installed, what's missing, and what to fix first. Or book a call and we'll walk through it together.
