Does a small business website need a privacy policy?

Ascent Vision · Published October 15, 2026

Often yes, and it is a sensible habit either way. California's online privacy law, CalOPPA, as the state Attorney General describes it, requires commercial websites that collect personally identifiable information, such as a name, email address or phone number, from California consumers to post a privacy policy. If any of your visitors are in California, a contact form can bring you within it. A short, honest policy says what you collect, why, who sees it and how to ask for deletion. This is a plain summary, not legal advice.

What the California Attorney General says

This is a plain summary, not legal advice. In an October 14, 2016 press release, the California Attorney General's office said that with CalOPPA's passage in 2003, California became the first state to require commercial websites and online services to post privacy policies. It said any operator, anywhere in the world, that collects personally identifiable information such as a name, address, email address or phone number from California consumers is required to comply.

As described in that 2016 release, the policy must include the categories of information collected, the types of third parties it may be shared with, how a consumer can review and request changes to their information, and the policy's effective date. It adds that a 2013 amendment requires policies to say how the operator responds to "Do Not Track" signals and whether third parties can collect personally identifiable information about the site's users.

The office's fact sheet "How to Read a Privacy Policy" cites the law as Business and Professions Code sections 22575 to 22579 and notes that other laws may also require a privacy policy. Neither page is the law itself or says how it applies to your business; that is a question for a lawyer.

What the FTC says

The Federal Trade Commission's guide "Protecting Personal Information: A Guide for Business" is about keeping data safe rather than about posting a policy, and it does not say every website must have one. Its advice is to know what you hold and to "Keep only what you need for your business", and it says that if you have no legitimate business need for sensitive personally identifying information, you should not keep it or even collect it.

The FTC's Consumer Privacy business guidance page tells companies to "reread your privacy policy" to make sure they are honoring the promises in it. The page frames a privacy policy as promises a company has made, so it should describe what you actually do.

What a plain policy should say

What you collect through your forms, such as name, phone, email and the message, and anything your site's tools collect automatically, if you use them.
Why you collect it, such as to reply to an inquiry and do the job.
Who sees it: you, your staff, and the companies that run your form, email or customer records.
How long you keep it.
How someone can ask to see, correct or delete their information, with a real email address or phone number.
The date the policy took effect.

Keep it true and easy to find

A copied template that promises things you do not do can cause more trouble than a short, honest policy. Link to it from every page's footer and next to your contact form, and update it when you add a tool that handles visitors' details. What the form itself should ask is covered in the related answer on contact forms.

Sources

Websites, upgraded or built

Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.

See the service Work with us