Editorial · May 25, 2018
Privacy Policy for Websites: What Every Page Should Include
Privacy policy for websites is a plain page that tells visitors what data you collect and what you do with it. If your site collects names, emails, payment details or even tracking data, you should have one. In some cases the law says you must.
Who needs one
If your site is a business site that collects personal information, assume the answer is yes. A contact form counts. So does a newsletter box, a checkout page or an analytics tool that tags visitors.
California has a law on this. The California Online Privacy Protection Act, Business and Professions Code sections 22575 to 22579, took effect July 1, 2004. It applies to operators of commercial websites and online services that collect personal information from California consumers. Those operators must post a privacy policy where visitors can see it and must follow it. It covers operators that collect personal information from California consumers, wherever the operator is based.
The state also sets a deadline. An operator is in violation if it fails to post a policy within 30 days of being told it is out of compliance.
Sources: California Attorney General, Privacy Laws page, which summarizes sections 22575 to 22579.
What the policy should say
Start with what the California law names. The policy must list the kinds of personal information you collect from visitors. It must also list the kinds of outside parties you may share that information with. It must also explain how you handle online tracking.
These three points make a good base for any site:
- What you collect. Names, email addresses, phone numbers, payment details, and data gathered by cookies or analytics.
- Who gets it. Payment processors, email services, hosting firms and ad networks. Name the type of company if you do not want to list each one.
- How you track visitors. Say whether you use cookies or similar tools, and why.
- How to reach you. Give an email address or a form for privacy questions.
Sources: California Attorney General, Privacy Laws page.
Do what you say
A privacy policy is a promise. The Federal Trade Commission tells businesses to think again if they believe they make no privacy claims, and to reread their policy to be sure they honor what they pledged. A policy copied from another site can promise things you do not do. That is worse than saying little.
Before you publish, walk through your own site. Check each form, each plug-in and each tool that sets a cookie. Then make sure the page matches what the site really does. Review it again whenever you add a new tool.
Sources: Federal Trade Commission, Privacy and Security, business center.
Special cases to watch
Some sites face extra rules. Three are worth knowing.
Children. The Children's Online Privacy Protection Act, or COPPA, gives parents control over what websites collect from their kids. The FTC's COPPA Rule adds steps for companies it covers. If your site is aimed at children, read the FTC's COPPA guidance first.
Financial firms. The Gramm-Leach-Bliley Act requires companies that offer loans, financial or investment advice, or insurance to explain how they share information and to protect sensitive data.
European visitors. The EU General Data Protection Regulation reaches full enforcement on May 25, 2018, today. It replaces the old EU Data Protection Directive. If your site targets people in Europe, a short notice is not enough, and you may want advice from a lawyer.
Sources: Federal Trade Commission, Privacy and Security, business center; EU GDPR Portal (eugdpr.org), an education site that is not an official EU resource.
Keep the data safe too
A policy says what you will do. Security is how you do it. The FTC's guide, Protecting Personal Information: A Guide for Business, rests on five principles.
- Take stock. Know what personal information you hold and where it lives.
- Scale down. Keep only what you need.
- Lock it. Protect what you keep.
- Pitch it. Dispose of what you no longer need.
- Plan ahead. Have a plan for security incidents.
The less data you collect, the shorter and truer your privacy policy can be.
Sources: Federal Trade Commission, Protecting Personal Information: A Guide for Business.
A quick checklist
- List every form, cookie and tool on your site that gathers data.
- Write the policy in plain words that match that list.
- Name the kinds of outside parties that receive data.
- Explain your tracking in a short paragraph.
- Link the policy from every page, such as in the footer.
- Review it each time the site changes.
This article is general information, not legal advice. A lawyer can check a policy against the rules that apply to your business.
Sources
- California Attorney General, Privacy Laws (oag.ca.gov/privacy/privacy-laws)
- Federal Trade Commission, Privacy and Security (ftc.gov/tips-advice/business-center/privacy-and-security)
- Federal Trade Commission, Protecting Personal Information: A Guide for Business (ftc.gov)
- EU GDPR Portal (eugdpr.org)