What Policy Pages Does a Small Business Website Need?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Most small business websites need a privacy policy, because almost every site collects some personal information through forms or tracking. Many also need website terms, a refund policy, a cancellation policy, and an accessibility statement, depending on what you sell and how. Put them where people can find them, usually the footer, and make sure what they say matches what you actually do.

What this means

Policy pages explain the rules between you and your visitors and customers. This page covers how to publish them on your site. The content of each policy has its own page in Part 11.

Page	What it covers	Main page in this guide
Privacy policy	What personal information you collect, why, who you share it with, and how people can reach you about it	11.1.10 Privacy Notice
Website terms	The rules for using your site	11.1.11 Website Terms
Refund policy	When and how customers get money back	11.1.8 Refund Policy
Cancellation policy	How customers cancel and any fees	11.1.7 Cancellation Policy
Accessibility statement	Your commitment to an accessible site and how to report a problem	9.7.3 Website Accessibility

A made-up dog grooming business, Happy Paws Mobile Grooming, takes bookings online, uses analytics, and charges a fee for late cancellations. It needs at least a privacy policy and a cancellation policy, plus a refund policy for unhappy customers.

Why it matters

Some states require a privacy policy. California’s Online Privacy Protection Act requires commercial websites that collect personal information from California residents to conspicuously post a privacy policy. The policy has to describe what information is collected, the kinds of third parties it’s shared with, and how the site handles online tracking. Your business doesn’t have to be in California for it to apply. Other states have their own privacy laws, too.
You have to follow your own policy. Under the California law, knowingly failing to follow your posted policy is a violation. The Federal Trade Commission (FTC) can also treat broken privacy promises as deceptive. A copied policy that doesn’t match what you do is a risk, not a shield.
Hidden fees cause disputes and chargebacks. Customers who didn’t see a cancellation fee before booking often dispute the charge (see 10.7.7 Chargebacks).
Some sales come with built-in cancellation rights. The FTC’s Cooling-Off Rule gives customers three days to cancel many sales made at their home of $25 or more, or at temporary locations like fairs of $130 or more. Sellers must give notice of that right and cancellation forms at the time of sale. There are exceptions, including repairs the customer asked you to come do.
Accessibility affects everyone’s access. The U.S. Department of Justice says the Americans with Disabilities Act (ADA) applies to the goods and services businesses open to the public offer online. A statement doesn’t make a site accessible, but it gives people a way to tell you about barriers.

Who this applies to

Privacy policy: nearly every business site. If you have a contact form, analytics, or a booking tool, you collect personal information.
Website terms: most sites, and especially sites that sell online, allow accounts, or let people post content.
Refund and cancellation policies: any business that takes payment, deposits, or bookings online, or sells products.
Accessibility statement: every site that serves the public.

Online stores and subscription businesses have extra rules on shipping, returns, and recurring billing (see 26.2 Shipping, Returns, and Recalls and 26.3 Recurring Billing).

How to do it

Map what your site collects. List every form, tool, plugin, and tracking script, and what each one collects and sends where (see 11.5 Data Map).
Write each policy from your real practices. Use the Part 11 pages for content. Don’t copy another business’s policy. It won’t match your tools.
Have an attorney review them. Privacy and consumer laws vary by state and change often.
Use plain language. Short sections, clear headings, and no legal filler you can’t explain.
Put a date on each policy. Show “Last updated” at the top.
Link them in the footer of every page. Also link the right policy next to the action it affects. Put the cancellation policy link beside the booking button. Put the privacy policy link beside forms (see 13.5 Website Forms).
Show key money rules before purchase. Deposits, cancellation fees, and refund limits should be visible before someone pays or books, not only on a separate page (see 11.3.2 Pricing Disclosures).
Give people a way to reach you about each policy. An email address or form that someone checks.
Check your state’s rules. Ask your state attorney general’s consumer protection office or an attorney whether your state requires anything more, like specific refund policy posting rules.
Review policies when anything changes. New form, new analytics tool, new booking software, or new fees. Update the policy and the date.

What proof to keep

A copy of each policy version with its date, so you can show what was posted when
Your data map at the time each privacy policy was written
Attorney review notes or emails
Screenshots showing policy links in the footer and next to forms and booking buttons

Keep these in your legal records folder. Don’t delete old versions.

Common mistakes

Copying a big company’s privacy policy. It describes their tools, not yours, and you may not follow it.
Forgetting tracking tools. Analytics, ad pixels, and chat widgets collect data. Your privacy policy has to cover them (see 13.7.1 Analytics Setup and Measurement Plan).
Policies nobody can find. A policy buried three clicks deep doesn’t help a customer or protect you.
Fees only in the fine print. Cancellation and deposit rules belong next to the booking button.
“Last updated 2019.” An old date tells people you don’t keep it current.
Saying “fully accessible” when it isn’t. Only describe what you’ve actually done.
Using a policy generator and never reading the result. Generators can help as a start, but you’re responsible for every line.

When to get help from a pro

An attorney who handles consumer protection or privacy: before you publish any policy. Ask:

Which privacy laws apply to my business based on where my customers live?
Do my refund and cancellation rules comply with my state’s laws?
Does the Cooling-Off Rule or a state version of it apply to my in-home sales?
Does my privacy policy match the tools my site actually uses?

A web accessibility specialist: before you write an accessibility statement, so it describes your site honestly.

Bill’s note

[Bill: add a short story or lesson here. For example, a client whose copied privacy policy mentioned tools they didn’t use, or how you put together SiteSmarty’s policy pages and who reviewed them.]

If you’d rather have this done for you, SiteSmarty builds websites with policy pages in place for your attorney to review.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: which policy pages SiteSmarty has and who reviewed them]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the SiteSmarty footer with policy links and the policy version log]
[Result so far:]

Questions people ask

Does my small business website need a privacy policy? Almost certainly, if it has a form, analytics, or booking tool. California law requires one for commercial sites that collect personal information from California residents, and other states have their own laws.

Do I need terms and conditions? They set the rules for using your site. They matter most if you sell online, have accounts, or let people post content. Ask an attorney what fits your business.

Do I have to post a refund policy? It depends on your state and what you sell. Some states have posting rules. Even where it isn’t required, a clear policy prevents disputes.

Do I need an accessibility statement? It’s a good practice that gives people a way to report problems. It doesn’t replace making the site accessible.

Can I copy another site’s privacy policy? No. It won’t match your tools, and you’re expected to follow what your policy says.

Audit check

Question: Does the website post dated, accurate privacy, terms, refund, cancellation, and accessibility pages that fit the business, with links in the footer and next to forms and booking buttons?
Pass looks like: Each needed policy is written from the business’s real practices, reviewed by an attorney, dated, and linked from every page. Money rules appear before purchase or booking. The privacy policy covers every form and tracking tool. Old versions are saved.
Fail looks like: No privacy policy. A copied policy that names tools the site doesn’t use. Fees hidden in fine print. Old dates. Policies that are hard to find.
Evidence to collect: Current and past policy versions with dates, the data map, attorney review notes, and screenshots of footer and in-context links.

Where this fits

Do this first: 11.1.10 Privacy Notice, 11.1.11 Website Terms, 11.1.7 Cancellation Policy, 11.1.8 Refund Policy, 9.7.3 Website Accessibility, 11.5 Data Map

Do this next: 13.4.8 Proof Page

Sources

State of California Department of Justice, Office of the Attorney General, "Privacy Laws" (California Online Privacy Protection Act) (checked October 16, 2026)
Federal Trade Commission, "Buyer's Remorse: The FTC's Cooling-Off Rule May Help" (checked October 16, 2026)
U.S. Department of Justice, ADA.gov, "Guidance on Web Accessibility and the ADA" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.