Does My Small Business Website Need a Privacy Policy?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

A privacy notice (also called a privacy policy) tells people what personal information you collect, how you use it, who you share it with, how long you keep it, and what choices they have. If your website collects personal information from people in California, state law requires you to post one. Whatever you write, you have to follow it, because the Federal Trade Commission (FTC) expects businesses to keep their privacy promises.

What this means

Your privacy notice is a public page on your website. It describes what really happens to customer information in your business. A typical notice covers:

What you collect: names, phone numbers, emails, addresses, payment details, photos, and website data like cookies
How you collect it: forms, calls, texts, booking tools, and website analytics
Why you use it: to quote, schedule, bill, follow up, and market
Who you share it with: your payment processor, scheduling app, email tool, and other vendors
How long you keep it (see 9.8.2 Record Retention Periods)
What choices people have: opting out of marketing, asking for a copy, or asking for deletion where the law gives that right (see 11.6.5 Customer Privacy Requests)
How to contact you about privacy

Made-up example: Brightside Cleaning collects names, addresses, phone numbers, and entry codes through its booking form. Its notice says it uses this to schedule and bill, shares it with its scheduling app and payment processor, keeps entry codes only while a client is active, and lets clients opt out of marketing texts by replying STOP.

Why it matters

Some states require one. California’s Online Privacy Protection Act (CalOPPA) requires commercial websites that collect personal information from California consumers to post a privacy policy and follow it. The policy must list the kinds of information collected, the kinds of third parties it’s shared with, and how the site handles online tracking.
Broken promises are a federal problem. The FTC tells businesses to reread their privacy policies and make sure they’re honoring the promises in them.
Customers look for it. People are more willing to fill out a form when they know what happens next.
Vendors and ad platforms may ask for it. Many tools expect you to disclose how you use their data. Check each tool’s terms.

Who this applies to

Any business with a website, form, booking tool, or mailing list. That’s nearly everyone.

Larger privacy laws may apply on top of that. For example, the California Consumer Privacy Act (CCPA) applies to for-profit businesses that do business in California and meet at least one threshold. According to California’s privacy agency, those include gross annual revenue over $26,625,000, or buying, selling, or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information. Many other states have passed their own privacy laws with different thresholds. Check the laws in the states where your customers live.

Some information has special rules, like health, financial, and children’s information (see 11.6.2 Sensitive Information).

How to do it

Map your data first. List what you collect, where it goes, and who touches it (see 11.5 Data Map).
Cut what you don’t need (see 11.6.1 Data Minimization). Less data means a shorter notice and less risk.
Write the notice in plain words using your real practices. Don’t promise anything you don’t do.
Name the kinds of vendors you share with, like payment, scheduling, and email tools.
Explain tracking. Say if you use analytics, ad pixels, or cookies, and how people can opt out where available.
Explain choices and how to contact you.
Post it on your website with a link in the footer and near every form (see 13.4.7 Policy Pages).
Add an “effective date” and update it when your practices change. Review it at least once a year.

What proof to keep

Each version of the notice with its effective date
Screenshots showing the footer link and form links
Your data map, so you can show the notice matches what you do
Records of privacy requests and how you handled them

Common mistakes

Copying a template that describes practices you don’t follow. A notice that promises “we never share your data” while you use a scheduling app is wrong on its face.
Forgetting website tracking tools. Analytics and ad pixels collect data too.
No effective date.
Never updating it after adding a new tool.
Hiding it. If customers can’t find it, it doesn’t help them or you.

When to get help from a pro

Attorney with privacy experience: especially if you collect health, financial, or children’s information, or serve customers in several states. Questions to ask:

Which state privacy laws apply to my business today?
Does my notice match what my website tools collect?
What rights do I have to offer customers, and how fast must I respond?

Bill’s note

[Bill: add a short note. For example, what you found when you checked the tracking tools on a client’s site, or why SiteSmarty puts a privacy notice link beside every form.]

If you’d rather have this done for you, SiteSmarty builds websites with policy pages and form links in place.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the data I listed, the tools I named, and where I posted the notice]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the SiteSmarty privacy notice page and a form showing the link]
[Result so far:]

Questions people ask

Is a privacy policy required by law? It depends on where your customers are and what you collect. California requires one for commercial websites that collect personal information from California consumers, and other state laws may apply too.

Can I use a template? As a starting point, yes. Then change it to match exactly what you collect and share.

What if I don’t follow my privacy policy? The FTC expects businesses to keep their privacy promises. Breaking them can lead to enforcement and lost trust.

Does the CCPA apply to my small business? Only if you do business in California and meet a threshold, like revenue over $26,625,000. Most very small businesses don’t, but CalOPPA can still apply.

Audit check

Question: Does the website post a privacy notice that accurately describes what the business collects, uses, shares, and keeps?
Pass looks like: A dated notice linked in the footer and near forms, matching the data map and website tools.
Fail looks like: No notice, a generic template that doesn’t match real practices, or a notice not updated after new tools were added.
Evidence to collect: The notice, its effective date, the data map, and a list of website tracking tools.

Where this fits

Do this first: 11.5 Data Map, 11.6.1 Data Minimization

Do this next: 11.1.11 Website Terms

Sources

California Attorney General, "Privacy Laws" (CalOPPA summary) (checked October 17, 2026)
California Privacy Protection Agency, "Does My Business Need to Comply with the CCPA?" (checked October 17, 2026)
Federal Trade Commission, "Consumer Privacy" (checked October 17, 2026)
Google Search Central, "Creating Helpful, Reliable, People-First Content" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.