Website Privacy Policy: Not the One From a Pizza Place

Scroll to the bottom of your website and find the “Privacy Policy” link. Click it. Now read the first paragraph out loud. If it names a different company, a different state, or a business that sells mattresses when you fix HVAC units, congratulations: you’ve met the policy somebody copy-pasted in 2018 and nobody’s opened since.

I see this all the time. It’s the page everyone knows they need and nobody wants to think about, so it gets the digital equivalent of a junk drawer. Let’s fix that without turning this into a law school lecture (I’m a web guy, not a lawyer, and you’ll see why that matters in a minute).

The short version

• A privacy policy should describe what your site actually collects, in plain words. Not what some other company’s site collected.
• If you have a contact form, analytics, a newsletter signup or a chat box, you’re collecting something, so you need to say so.
• Have it match reality, keep it linked in the footer, and put a date on it so you know when someone last looked.

Does a small business website really need a privacy policy?

In most cases, yes. If your site has a contact form, an email signup, analytics, embedded maps or a booking tool, it collects information about visitors, and a privacy policy is where you tell people what happens to it. Many of the tools you plug in (analytics, ad platforms, payment processors) also ask you to have one as part of their own terms.

Whether the law in your state or your customers’ states requires specific wording is a question for an attorney. I’ll say that again because it matters: I’m not giving legal advice here. What I can tell you from the website side is that having no page, or a page that describes some other business, is the worst of both worlds.

What should a privacy policy actually say?

It should say what you collect, why you collect it, who else touches it, and how a person can reach you about it. That’s the whole job. Four questions, answered in normal English.

• What you collect: name and email from the contact form, phone number from the booking tool, browsing data from analytics.
• Why: to answer inquiries, schedule appointments, see which pages people read.
• Who else sees it: your email provider, your form plugin, your analytics tool, your payment processor.
• How to reach you: a real email address that a human checks.

That’s a policy a customer can read in two minutes. Compare that to the 4,000-word wall of “heretofore” that most templates spit out. Nobody reads it, including you, which is how you end up promising things your site doesn’t do.

Why is a copied privacy policy a problem?

A copied policy describes someone else’s website, so it makes claims about your site that may not be true. Maybe it says you never share data with third parties, while your site loads an ad pixel, a chat widget and a map. Maybe it mentions a mobile app you don’t have. Maybe it still says “Acme Pizza LLC.”

(Yes, I’ve seen a policy for a plumber that was clearly lifted from an online clothing store, down to the return window. Very thorough on sweaters. Silent on pipes.)

The fix isn’t scary. Look at what your site really does, then write that down. It’s about an hour of work the first time, and then it’s a ten-minute check whenever you add a new tool.

How do I know what my website collects?

Start by listing every form, plugin and embedded tool on your site, because each one is a possible data collector. Walk through your own site like a visitor and write down every place someone can type something or click “allow.”

1. Contact and quote forms (and where the submissions land).
2. Email signup boxes and who runs the list.
3. Analytics, ad pixels, heat map tools.
4. Chat widgets, booking calendars, payment buttons.
5. Embedded videos and maps, which often set their own cookies.

If a plugin got installed three years ago by someone who’s no longer around, it still counts. That’s the same energy as knowing who actually owns your domain: you can’t protect what you can’t list.

Where should the privacy policy link go?

Put it in the footer of every page, and right next to any form that collects an email or phone number. Footer links are where people (and a few automated checkers) expect to find it, so don’t hide it under three menu levels.

Add a “last updated” date at the top. It sounds minor, but a date from 2018 tells a visitor, and you, exactly how long the junk drawer has been closed. If your site also has accessibility homework hanging over it, it’s worth checking that at the same time, which is what my ADA compliance work covers.

Questions people ask

Can I just use a free privacy policy generator?

A generator is a fine starting draft, but only if you edit it to match what your site really does. The generator doesn’t know you installed a chat widget last spring. You do. For anything that touches legal requirements, have an attorney look it over.

Is a privacy policy the same as terms of service?

No. A privacy policy covers what you do with visitor information. Terms of service cover the rules for using your site or buying from you. Plenty of small sites need both, and they’re separate pages.

How often should I update it?

Any time you add or remove something that collects data, and at least once a year as a sanity check. Put a reminder on the calendar. It beats finding out the hard way that your policy still mentions a tool you dumped in 2021.

So what now?

Open your privacy page tonight and read it like a stranger would. If it’s wrong, missing or about somebody else’s business, that’s a quick fix, and it’s the kind of thing I handle during a regular site cleanup. If you want a second set of eyes on the whole site, tell me what you’ve got and I’ll tell you what’s actually worth fixing. And if you’ve been wondering how any of this fits together, the FAQ is a decent place to start.