Does My Small Business Website Need a Privacy Policy?
Quick answer
If your website collects anything — form submissions, analytics, or payments — a plain privacy page is sensible and expected. It should say what you collect, why, who else touches it, roughly how long you keep it, and how to contact you about it. Actual legal requirements vary by where you and your customers are, what data you collect, and your industry, so get legal advice for your situation. This isn't legal advice.
Why it's worth having regardless
Beyond any legal question, it's a trust signal. Someone about to type their phone number into a form is reassured by a page that says plainly what happens next. It also forces you to actually know what your own site collects, which is a useful exercise.
What a plain policy covers
- What you collect: form fields, any analytics, payment details handled by a processor.
- Why you collect it: to reply to inquiries, quote work, take payment.
- Who else is involved: your form or email provider, analytics, payment processor.
- Roughly how long you keep inquiries and records.
- Whether you send marketing messages, and how someone opts out.
- How to contact you with a question or a deletion request.
Be accurate above all
A policy that describes cookies you don't set or analytics you don't run is worse than a short honest one. Check what your site actually loads, then describe that. If you add a chat widget, an ad pixel, or email marketing later, update the page.
Where the rules genuinely vary
Obligations depend on your location, your customers' locations, what data you handle, and your sector — health, finance, and anything involving children are treated differently. Rules also change. If you sell across borders, handle sensitive information, or run ad tracking, that's a conversation with a lawyer, not a template.
Related pages people expect
Terms of service if you sell or take bookings online, and a short note about text messages if you ever text customers. Consent for marketing messages is its own topic — see should I automate text messages to leads.
Keep it findable and readable
A link in the footer, on every page, in normal language. Don't paste in dense boilerplate you haven't read. And if your form promises you won't share details, make sure that's actually true — see what makes a website trustworthy.
Still not sure what you need?
Give me what you have. I'll help with the rest. No pressure, and nothing is due until your site is built and you like it.
Related answers
- What Makes a Small Business Website Look Trustworthy?
The specific, checkable things that make a stranger believe you're a real business.
- What Makes a Good Contact Form for a Small Business?
What to ask, how many fields it needs, and why reliable delivery matters most of all.
- Does My Business Website Need HTTPS or SSL?
Yes — it's baseline now, especially with forms. But it isn't total security.