Privacy policy for a small business website: do you need one?

If your website has a contact form, a booking link, a newsletter signup or visitor statistics, it collects personal information, and most small businesses in that position put a short privacy policy on the site. For many it is also required: by the tools they use, by some state laws, and by ad platforms. A plain, honest page of a few paragraphs usually covers a small local business. This guide explains when owners typically need one and what it usually says. It is not legal advice; for your situation, check with your attorney.

What counts as collecting information

Owners are often surprised by how much a simple site collects. Look at yours:

Contact form: names, phone numbers, email addresses and whatever customers type in the message.
Booking tool: names, contact details, appointment times, sometimes notes about health, pets or a home.
Newsletter signup: email addresses.
Visitor statistics, such as Google Analytics: information about visits, devices and rough locations, often with a cookie.
Ads and tracking pixels, such as the Meta pixel or Google Ads tags: visits matched to ad accounts.
Embedded content: a Google map, a YouTube video or a social feed can set cookies of their own.
Payments, through a PayPal, Square or Stripe link: those companies handle the card, but your site sends customers there.

If your site has any of these, you are collecting information, even if you never look at the statistics.

When owners usually need one

There is no single federal law in the US that requires every website to have a privacy policy. But several things often make one necessary in practice:

State laws. California's online privacy law (CalOPPA) requires a privacy policy for commercial websites that collect personal information from California residents, wherever the business is based. Several other states have privacy laws too, though many of those apply only above certain business sizes. Your attorney can tell you which apply to you.
The tools you use. Google Analytics, Google Ads, the Meta pixel and many booking and newsletter services require, in their terms, that you tell visitors about the data they collect.
Honesty rules. The FTC treats it as deceptive when a business says one thing about privacy and does another. That matters more once you have a policy, because you must then follow it.
Customer trust. People hesitate to type their phone number into a form on a site with no word about what happens to it.

For a small local business with a form and basic statistics, a short policy is the norm.

What a plain privacy policy usually says

A small business policy can be written in ordinary English. It usually covers:

Who you are and how to reach you: business name, address, email.
What you collect: what people type into your forms, plus basic visit information from your statistics tool.
Why you collect it: to answer enquiries, schedule appointments, send the newsletter people asked for, understand how the site is used.
Who else sees it: the services that run your site, form, booking, email and statistics. You do not need to list every company, but name the main kinds, and the main ones if you use ads.
Whether you sell it. Most small businesses do not, and should say so plainly.
Cookies, in a sentence or two: what they are used for on your site and how visitors can block them in their browser.
How long you keep things, roughly: "We keep enquiries as long as we need them to serve you and for our records."
How people can ask to see, correct or delete their information, and who to contact.
Children: that the site is not aimed at children under 13 and you do not knowingly collect their information. Rules for children's data are stricter; the FTC explains them on ftc.gov.
The date it was last updated.

Where to put it

A link in the footer of every page, labeled "Privacy" or "Privacy policy".
A short line next to the contact form: "We use your details only to reply to you. See our privacy policy."
On the newsletter signup and any booking form you control.

The policy is its own page, with a plain address like yourbusiness.com/privacy.

Templates and generators

Many owners start from a template or an online generator. That can be a reasonable start, but read the result carefully:

Delete what does not apply. Templates often mention online stores, user accounts or mobile apps you do not have.
Add what is missing. Make sure your actual tools are covered: your booking service, your statistics, any ad pixel.
Keep the language plain. If you cannot explain a sentence to a customer, rewrite it or ask someone who can.

If you handle sensitive information, such as health details at a clinic, financial details at an accounting firm or anything about children, ask an attorney to write or review it. Other rules, like HIPAA for health providers, may apply.

Keep it true over time

A privacy policy has to change when your site changes. Update it when you:

Add a new form, booking tool or newsletter.
Start running ads with a tracking pixel.
Add or remove a statistics tool.
Change who handles your email or customer list.

Change the date at the top each time.

A privacy policy explains what you do with people's information. Terms of service explain the rules for using your site and services, and are a different page; terms of service for small business websites covers when those matter. A cookie banner is something else again, and for many US businesses not needed at all; see cookie banners on a US website.

What to do this week

List what your site collects: forms, booking, signup, statistics, ad pixels, embeds.
Check whether your site already has a privacy page, and whether it describes what you really do.
Draft or update a short policy covering the ten points above, in plain words.
Link it in the footer and next to each form.
If you handle health, financial or children's information, ask your attorney to review it.

If your current site has no footer links and no clear place for a privacy note, you can see your site rebuilt first and add your own policy text once you have it.