Why Every Website Needs a Privacy Policy (And What to Include)

Who actually needs a privacy policy?

If your website does any of the following, you need a privacy policy:

• Uses Google Analytics, Plausible, or any analytics tool (you collect IP addresses)
• Has a contact form (you collect email addresses)
• Runs Google AdSense or any ad network (third parties collect data)
• Has user accounts or sign-ups
• Sells products or services online
• Uses cookies beyond strictly necessary session cookies

In practice, that's essentially every website. Even a simple blog with Google Analytics legally requires one under GDPR if any EU visitors access it.

The laws you need to know

What your privacy policy must include

1. What data you collect — be specific: IP addresses, email addresses, names, payment info, browser type, cookies, location data.
2. Why you collect it — the purpose for each category of data (analytics, marketing, service delivery, legal compliance).
3. How long you keep it — data retention periods for each type of data.
4. Who you share it with — list all third parties: analytics providers, ad networks, payment processors, cloud hosting providers, email marketing tools.
5. User rights — under GDPR: right to access, rectify, erase, port, and object. Under CCPA: right to know, delete, opt out.
6. Cookie information — what cookies you set, their purpose, and how users can opt out.
7. Contact information — who to contact with privacy questions. Under GDPR, if you have EU users at scale, you may need a Data Protection Officer.
8. Last updated date — your policy must be current and you should notify users of significant changes.

Common mistakes

• Copying a competitor's policy — it won't match your actual data practices and creates legal liability
• Burying it in the footer — it needs to be easily accessible, especially before data collection (e.g., linked from sign-up forms)
• Not updating it — adding a new analytics tool, ad network, or feature without updating the policy is a violation
• Vague language — "we may share data with partners" is insufficient under GDPR. You need to name the categories of recipients
• Missing international transfer info — if you're in the EU and use US-based services (like AWS or Google), you must disclose the data transfer mechanism

Privacy policy vs. cookie policy vs. terms of service

• Privacy policy — explains how you collect, use, and protect personal data. Required by law in most jurisdictions.
• Cookie policy — a focused document specifically about cookies. Can be a separate page or a section within your privacy policy. Required under EU ePrivacy Directive.
• Terms of service (ToS) — the contract between you and your users. Not legally required but strongly recommended. Covers permitted use, your liability limitations, and dispute resolution.