What a privacy policy is for
A privacy policy, sometimes called a privacy notice, is a page that explains what personal information a website collects, why, what happens to it and what choices people have. It is a form of openness. Visitors cannot see behind the scenes of a site, so the page tells them what is going on.
Many countries and regions have rules about this, and the requirements differ by place, by type of site and by the kind of information involved. This article describes common contents in general terms and is not legal advice. If your site collects sensitive details, serves children, or sells to people in several regions, consider asking a qualified professional to review your notice.
Start with what the site really does
The most important principle is that the policy must describe reality. Before writing a word, list what your site actually does with information. Look at each place where something is collected or recorded:
- contact forms and email sign-ups
- accounts, logins and checkout pages
- comments and reviews
- analytics tools
- embedded maps, videos or social buttons
- advertising or tracking scripts
- payment services
- server logs kept by the host
- email you send and receive through the site
Embedded and add-on tools often collect information on their own, so check what each one does. A policy that says “we collect nothing” while the page runs analytics and advertising scripts is misleading. A policy borrowed wholesale from another site will probably describe somebody else’s practices, not yours.
Typical sections
Policies vary, but most cover the following ground.
Who you are and how to reach you
Give the name of the person or organization responsible for the site and a way to get in touch about privacy questions, such as an email address or form. Where rules require it, you may also need to name a specific contact or representative.
What information is collected
Describe the types of information in ordinary words. Typical categories include:
- details people give you directly, such as name, email address, messages and order details
- information collected automatically, such as device type, browser, approximate location from an internet address and pages visited
- information from cookies and similar technologies
Say only what applies. A short, accurate list is better than a long, vague one. Understanding personal data in general helps you spot what counts; it often covers more than people expect, including online identifiers.
Why it is used
Explain the purposes: replying to messages, delivering orders, sending a newsletter, keeping the site secure, understanding which pages are useful, or meeting legal and accounting duties. Some laws expect a stated basis for each use. Avoid vague catch-alls such as “to improve our services” as the only explanation.
Who it is shared with
Many sites rely on outside services for hosting, payments, email delivery or analytics. State the kinds of recipients, such as payment processors or hosting providers, and say whether information is sold or shared for advertising, if it is. If data is transferred to other countries, some rules expect this to be mentioned.
Cookies and similar tools
Explain which kinds of cookies the site uses and what they are for. This page and a cookie banner should agree. For how banners work and the choices they offer, see the explanation of cookie notices and consent banners, and for the broader picture, tracking cookies and how advertising systems use them.
How long it is kept
State how long you keep each kind of information, or how you decide. “Only as long as needed for the purpose described” is a common phrase, but concrete periods, where you can give them, are more useful. Do not promise deletion you cannot carry out.
How it is protected
Describe protective measures in general terms, such as secure connections and restricted access. Be modest. No site can promise complete safety, and claims like “100% secure” are best avoided. Honest wording is more trustworthy than absolute claims.
Visitors’ rights and choices
Depending on where visitors live, they may have rights to see the information held about them, correct it, ask for its deletion, object to certain uses, or withdraw consent. Explain what they can do and how to ask. Also explain how to unsubscribe from emails, which relates to email consent, and how to change cookie choices.
Children
If your site is not intended for children, say so. If it may be, the rules are usually stricter, and professional advice is especially sensible.
Changes to the policy
Say that the policy may change, show the date of the last update, and, for significant changes, consider telling people directly.
Writing it clearly
A policy is only useful if people can read it.
- Use plain language and short sentences. Avoid legal-sounding filler.
- Use headings so visitors can scan for the topic they care about.
- Put a short summary at the top if the policy is long.
- Use the same terms the rest of the site uses.
- Make the page easy to find, usually through a link in the footer of every page and near any form that collects information.
Many tools and templates exist for generating policies. They can provide a useful skeleton, but treat the output as a draft to be checked against your real practices. Remove the sections that do not apply and add the ones that do.
Keep it accurate
A privacy policy is not a one-off document. Review it whenever you:
- add a new form, plugin, analytics tool or embedded service
- start a newsletter or begin selling something
- change your hosting or payment provider
- begin advertising or measuring visitors in a new way
- change how long records are kept
Putting a policy review into your regular maintenance schedule works well. If you collect email addresses, build the list carefully and respectfully; the same openness that underlies the policy applies to how you gather and use addresses.
What a policy does not do
A privacy page does not by itself make a site safe or lawful. Handling information responsibly means collecting less, protecting accounts with strong passwords and updates, and deleting what you no longer need. The page simply reports those choices honestly. If the site does one thing and the page says another, the page is not protecting anyone, including you.