Do I Need a Privacy Policy?
A practical test for whether your site legally needs a privacy policy, which laws apply, and what happens if you skip it.
Almost certainly yes — and the reason is usually more mundane than people expect. A privacy policy is not triggered by running a big business; it is triggered by handling personal data at all. An email address in a contact form, an IP address in an analytics log, a cookie set by an ad network, or a shipping address at checkout is enough.
Here is a faster way to answer it than reading statutes. Open your site in a private window, then open your browser's developer tools and look at the Application or Storage tab and the network requests. If anything is stored on the visitor's device beyond a session cookie your own site set, or if any request leaves for a domain you do not control, you are handling personal data and you need a policy.
When the law requires one
Under the EU and UK GDPR, Articles 13 and 14 require you to give people specified information at the point you collect their data — who you are, what you collect, why, on what lawful basis, who receives it, how long you keep it and what rights they have. A privacy policy is how that is normally delivered. This applies to a business outside the EU that offers goods or services to people in the EU, so a US or Australian store shipping to Germany is in scope.
In California, the CCPA as amended by the CPRA requires a notice at collection and a privacy policy if you are a for-profit business that meets one of its thresholds — broadly, more than $25 million in annual revenue, or handling the personal information of 100,000+ California consumers or households, or deriving 50% or more of revenue from selling or sharing personal information. Note that 'sharing' includes disclosing data for cross-context behavioural advertising, which is what most ad pixels do.
Australia's Privacy Act 1988 (APP 1) requires a clearly expressed and up-to-date policy for APP entities, which generally means businesses with turnover over AUD $3 million plus specific categories such as health service providers regardless of size. Canada's PIPEDA has an openness principle with much the same effect for commercial activity.
When the law is beside the point
Even if no statute reached you, the companies you depend on will. Stripe's and PayPal's terms require a published policy. Apple will not accept an App Store submission without a policy URL, and Google Play requires one plus a matching Data Safety declaration. Google AdSense requires disclosures about third-party ad cookies. Mailchimp, Meta's Business Tools terms and Shopify's merchant terms all say something similar.
In practice this is why most sites publish one: not the threat of a fine, but the risk of losing payments, ads, email or a store listing at short notice.
A worked example
Take a one-person Squarespace site selling a course. It has a contact form (email, name, message), Squarespace analytics, a Stripe checkout, a Mailchimp signup and a YouTube embed. That is five disclosures: form data and how long you keep it; analytics cookies; payment data handled by Stripe as a processor; email marketing including how to unsubscribe; and the fact that YouTube sets cookies when the embed loads. A generic template that mentions none of those five is worse than useless — it is inaccurate, and inaccuracy is itself a compliance problem.
What happens if you do not publish one
The headline numbers are real but rare for small businesses: up to €20 million or 4% of global turnover under GDPR, and civil penalties per violation under the CCPA. Far more common outcomes are a complaint you have to answer, an app removed from a store, an ad account limited, or a payment processor holding funds until you fix it.
This article is general information, not legal advice. If you handle health, financial or children's data, or you operate in a regulated industry, have a qualified lawyer in your jurisdiction review what you publish.
Next steps
Generate a draft in the privacy policy generator, then edit it against the actual list of tools in your account. Link it in your site footer so it appears on every page, and again next to any form that collects data. If your site sets non-essential cookies, pair it with a cookie policy and a consent banner.