Does Your Website Need a Privacy Policy? State Privacy Laws Explained

If your website has a contact form, a newsletter signup, a checkout page or Google Analytics, you are collecting personal information. Once you do that, the question is not really “do I need a privacy policy?” but “which rules does my privacy policy have to meet?”

There is no single federal law that says every US website must post a privacy policy. Instead, a set of state laws, federal rules for specific situations and the terms of the tools you already use add up to a requirement that almost every business site has to meet. This guide explains when each one applies and what your policy needs to say.

This is not legal advice. Privacy laws change often, so confirm the details for your business with a qualified attorney.

The short answer: almost every business website needs one

Three things make a privacy policy close to universal for US businesses:

1. California’s Online Privacy Protection Act (CalOPPA). It requires any commercial website or online service that collects personally identifiable information from California residents to post a privacy policy conspicuously. There is no revenue or traffic threshold. If anyone in California can fill out your contact form, it reaches you.
2. Your software contracts. Google Analytics’ terms of service say you must post a privacy policy that discloses your use of cookies and of Google Analytics itself. Ad platforms, payment processors and app stores have similar requirements.
3. State comprehensive privacy laws. Around 20 states now have broad consumer privacy laws with detailed notice rules. Most only apply above a certain size, but some reach smaller firms. See our guide to US state data privacy laws for the full list with effective dates.

Key takeaway: If your site collects names, emails, phone numbers, payment details or tracking data from anyone in California, you need a privacy policy. Size thresholds only decide how detailed it must be.

CalOPPA: the law that reaches the smallest sites

CalOPPA (California Business and Professions Code sections 22575 to 22579) was enacted in 2003. It covers operators of commercial websites and online services that collect personally identifiable information, such as a name, address, email address or phone number, from California consumers.

Under section 22575, the policy must:

• List the categories of personal information you collect and the categories of third parties you may share it with
• Describe how users can review and request changes to their information, if you offer that
• Explain how you notify users of material changes to the policy
• Show the policy’s effective date
• Disclose how you respond to “Do Not Track” browser signals, if you collect data about users’ activity across other sites
• Disclose whether other parties, such as ad networks, may collect information about users’ activity over time and across sites when they visit yours

The Do Not Track and third-party tracking items were added by a 2013 amendment (AB 370). You don’t have to honor Do Not Track signals under CalOPPA, but you must say what you do with them.

“Conspicuously posted” generally means a clearly labeled link on your homepage, which is why most sites put “Privacy Policy” in the footer. Under the statute, an operator is in violation if it fails to post a compliant policy within 30 days of being notified of noncompliance.

Two other states have similar website-level laws. Delaware’s Online Privacy and Protection Act requires commercial online services that collect personal information from Delaware residents to make their privacy policy conspicuously available. Nevada (NRS 603A.340) requires website operators to post a notice covering the information collected, third-party sharing and how consumers can request changes.

State comprehensive privacy laws: when they apply

The newer wave of state laws, starting with California’s CCPA and Virginia’s VCDPA, goes much further than CalOPPA. They give consumers rights to access, delete and correct their data and to opt out of sales and targeted advertising, and they set out detailed privacy notice content.

Most apply only when you cross a threshold. The table shows how a few common ones work.

Thresholds are only a summary. Each law has exemptions, for example for data covered by HIPAA or the Gramm-Leach-Bliley Act, and the definitions of “consumer” and “sale” differ. California also adjusts its dollar threshold for inflation every odd-numbered year.

For most local service businesses with a few thousand customers, the comprehensive laws will not apply yet. Ecommerce stores, apps and lead-generation sites can cross 35,000 or 100,000 consumers faster than you’d expect, because website visitors tracked by cookies can count as consumers.

What a compliant privacy policy covers

Whether you are only under CalOPPA or under several state laws, a solid small-business policy covers the same core sections. Virginia’s law, which many later states copied, requires a “reasonably accessible, clear, and meaningful” notice that lists the categories of personal data you process, why you process it, how consumers exercise their rights and appeal, what you share with third parties and the categories of those third parties.

A practical outline:

1. Who you are and how to contact you. Business name, address and a working email or form.
2. What you collect. Information people give you (forms, orders, accounts), information collected automatically (cookies, IP address, device data) and information from other sources.
3. Why you collect it. Fulfilling orders, answering inquiries, marketing, analytics, security.
4. Who you share it with. Categories such as payment processors, email platforms, shipping carriers, analytics and advertising partners.
5. Cookies and tracking. The tools you use, including Google Analytics and ad pixels, and how people can opt out. Include your Do Not Track response.
6. Sales and targeted advertising. Whether you “sell” or “share” data as the state laws define those terms, and how to opt out. California requires a “Do Not Sell or Share My Personal Information” link if you do.
7. Privacy rights. How people can request access, deletion or correction, and how to appeal a decision, if a state law gives them those rights.
8. Retention and security. How long you keep data and the general measures you use to protect it. A written data retention policy makes this section easy to write honestly.
9. Children. Whether your site is directed at children under 13.
10. Changes and effective date. How you will announce updates, plus the “last updated” date.

Federal rules you can’t ignore

Two federal frameworks matter even for small sites.

The FTC Act. The Federal Trade Commission’s privacy guidance states that if you make privacy promises, “the FTC Act requires you to live up to those claims.” A privacy policy that says you never share data, while your site runs ad pixels that share browsing data with ad platforms, is a deception risk. Write what you actually do, not what sounds reassuring.

COPPA. If your site or app is directed at children under 13, or you know you collect data from them, the Children’s Online Privacy Protection Rule requires a specific online notice and verifiable parental consent. The FTC’s amended COPPA Rule took effect June 23, 2025, with most compliance obligations due by April 22, 2026. It adds requirements such as a written data retention policy disclosed in your notice.

Industry rules also apply. Health practices have HIPAA notice requirements, and financial firms have Gramm-Leach-Bliley privacy notices, which pair with the FTC Safeguards Rule.

Mistakes that cause problems

• Copying a big company’s policy. It will describe practices you don’t have and miss the tools you do use.
• Using a generator and never updating it. Every new pixel, chatbot or email platform changes what you collect and share. The CCPA requires covered businesses to update their privacy policy at least every 12 months.
• Hiding the link. Put it in the site footer and near forms that collect data.
• Forgetting forms and chat widgets. Lead forms, booking tools and live chat often send data to third parties you didn’t list.
• Ignoring cookie banners where they matter. US state laws mostly use an opt-out model, but if you have EU or UK visitors you may need consent before setting non-essential cookies.

Where to start: a 6-step plan

1. Inventory your data. List every form, plugin, pixel, analytics tag, booking tool and payment provider on your site. Note what each collects and where it sends data.
2. Check your thresholds. Estimate how many consumers’ data you handle per state per year, and whether any revenue comes from selling or sharing data.
3. Draft the core sections from the outline above, in plain language that matches your actual practices.
4. Add state-specific sections if you cross a threshold, such as California rights disclosures and opt-out links.
5. Post it conspicuously. Footer link on every page, plus links next to signup and checkout forms. Pair this work with an accessibility review since you are already touching templates.
6. Set a review date. Revisit the policy at least once a year and whenever you add a new tool. If you are building a new site, add this to your small business website launch checklist.

Before finalizing, have an attorney review it, especially if you sell online nationally, handle health or financial data, or serve children.

Conclusion

For nearly every US business with a website, a privacy policy is required, not optional. CalOPPA alone reaches any commercial site that collects personal information from Californians, and the tools you use require one by contract. The bigger state laws decide how detailed it has to be. Start with an honest inventory of what your site collects, write a policy that matches it, and review it every year. For definitions of terms like “controller” and “sale,” see our glossary.

Sources

• California Business and Professions Code § 22575 (CalOPPA) — required privacy policy contents and 30-day notice provision
• California Attorney General: CCPA — CCPA applicability, privacy policy and notice at collection requirements
• California Privacy Protection Agency: Updated monetary thresholds — $26,625,000 revenue threshold from January 1, 2025
• Code of Virginia § 59.1-578 — privacy notice content under the VCDPA
• FTC: Privacy and Security business guidance — duty to live up to privacy promises
• Federal Register: Children’s Online Privacy Protection Rule (April 22, 2025) — amended COPPA Rule effective and compliance dates