The privacy policy myth
Many small business owners believe privacy policies are only for tech companies and e-commerce giants. The truth is simpler and more urgent: if your business collects any personal information from customers, employees, or website visitors, you likely need a privacy policy. And "personal information" is far broader than you think.
Do you have a website with a contact form? A mailing list? An appointment booking system? Do you accept credit card payments? Keep customer records? Have security cameras? All of these involve collecting personal information, and an increasing number of federal and state laws require you to disclose how you handle that data.
What counts as personal information
Personal information includes any data that can identify an individual, directly or indirectly:
- Names, email addresses, and phone numbers
- Physical and mailing addresses
- Payment information (credit card numbers, billing addresses)
- Appointment history and service records
- Photos and videos (including security camera footage)
- IP addresses and website browsing data (cookies, analytics)
- Social Security numbers and government IDs
- Health information (relevant for clinics, spas, and fitness businesses)
- Employee records and payroll data
Laws that require privacy policies
California Consumer Privacy Act (CCPA/CPRA)
If your business collects data from California residents AND meets any of these thresholds, CCPA applies:
- Annual gross revenue over $25 million
- Buy, sell, or share personal information of 100,000+ consumers
- Derive 50% or more of revenue from selling personal information
Even if you do not meet these thresholds, having a privacy policy demonstrates good faith and protects against California's other privacy laws.
State privacy laws spreading fast
Following California's lead, multiple states have enacted comprehensive privacy laws:
- Virginia (VCDPA): Effective 2023
- Colorado (CPA): Effective 2023
- Connecticut (CTDPA): Effective 2023
- Utah (UCPA): Effective 2023
- Texas (TDPSA): Effective 2024
- Oregon (OCPA): Effective 2024
- Montana (MCDPA): Effective 2024
More states pass privacy legislation every year. A strong privacy policy positions your business for compliance regardless of where your customers are located.
Industry-specific requirements
- Healthcare: HIPAA requires specific privacy notices for Protected Health Information
- Financial: Gramm-Leach-Bliley Act requires privacy notices for financial data
- Children's data: COPPA applies if you collect data from children under 13
- Payment processing: PCI DSS requires policies around cardholder data
Website requirements
If your website uses cookies or analytics tools (Google Analytics, Meta Pixel, etc.), several laws require disclosure:
- Google requires a privacy policy for any site using Analytics
- Apple App Store and Google Play require privacy policies for all apps
- GDPR applies if you have visitors from the European Union
What your privacy policy must include
Essential elements
Every privacy policy should clearly explain:
- What information you collect: Be specific about categories (contact info, payment data, browsing data)
- How you collect it: Forms, cookies, third-party sources, in-person
- Why you collect it: Service delivery, marketing, legal compliance, improvement
- How you use it: Order processing, appointment scheduling, email marketing
- Who you share it with: Payment processors, marketing platforms, analytics providers, legal authorities
- How you protect it: Security measures, encryption, access controls
- How long you keep it: Retention periods by data type
- Consumer rights: What rights customers have regarding their data
- How to contact you: Designated contact for privacy questions and requests
State-specific disclosures
Depending on your state and your customers' states, you may need to include:
- Right to access personal information
- Right to delete personal information
- Right to opt out of data sales
- Right to correct inaccurate data
- Non-discrimination notice (cannot penalize customers who exercise privacy rights)
- Categories of data sold or shared in the preceding 12 months
Where to display your privacy policy
Your privacy policy must be easily accessible. Required and recommended locations:
- Website footer: Link on every page (required by most privacy laws)
- Point of collection: Near contact forms, signup forms, and checkout
- Email marketing: Link in the footer of all marketing emails
- Physical location: Available upon request if you collect data in person
- Job applications: If you collect applicant data online
- Mobile apps: Accessible within the app and on app store listing
Common privacy policy mistakes
Using a generic template without customization
A privacy policy copied from another website will not reflect your actual data practices. Worse, if it promises something you do not actually do (like annual data deletion), it creates liability.
Not listing all third-party services
If you use Mailchimp, Google Analytics, Square, Stripe, Calendly, or any other third-party service that processes customer data, your privacy policy should disclose this.
Forgetting employee data
Privacy policies often focus on customers and forget that employee data collection also requires disclosure in many states.
Never updating
Your privacy policy should be reviewed whenever you:
- Add a new software tool or service
- Change how you use customer data
- Expand to a new state or market
- State or federal privacy laws change
How ComplyStack generates compliant privacy policies
Writing a privacy policy that complies with your state's specific laws requires legal research most small business owners do not have time for. ComplyStack generates customized privacy policies based on your business type, location, and the types of data you collect — ensuring compliance with applicable state and federal requirements. Generate yours in minutes, not billable attorney hours.
