Does my website need a privacy policy?

Yes, almost certainly. If your website collects any personal data, and a contact form, a newsletter sign-up, analytics, an embedded video or even server logs with IP addresses all count, the GDPR requires you to tell visitors what you do with it, and a privacy policy is how websites do that. California's CalOPPA requires a posted policy from any commercial website that collects personally identifiable information from California residents, and Google Analytics' own terms require one. The only sites that can do without are those that collect nothing at all, which is rarer than it sounds.

What counts as collecting personal data?

More than most site owners think:

• Forms. A name and e-mail address in a contact form, a newsletter sign-up, a comment.
• Accounts and orders. Customer accounts, addresses, order history.
• Analytics and advertising. Cookie identifiers and the data tied to them are personal data under the GDPR when they can single out a visitor.
• Embeds and widgets. A YouTube video, a map, a chat widget or a font loaded from a third-party server sends the visitor's IP address to that provider.
• Server logs. The Court of Justice ruled in Breyer (C-582/14, 2016) that a dynamic IP address can be personal data for a website operator that has the legal means to identify the person with the help of the internet access provider.

A static brochure site with no forms, no analytics, no embeds and self-hosted fonts may collect nothing beyond what the host logs for security. Even then, a short policy saying exactly that is cheap insurance.

Which laws require one?

In practice, if your audience is international, one policy written to the GDPR standard covers most of these, with a section for California and other US states.

Do third-party tools require one?

Often, yes, independently of the law. Google Analytics' terms of service require you to post a privacy policy that gives notice of your use of cookies and discloses your use of Google Analytics and how it collects and processes data. App stores, advertising networks and payment providers have similar clauses. Breaking those terms can get the account suspended even where no regulator is watching.

What must the policy contain?

For the GDPR, articles 13 and 14 list the content:

1. Who you are and how to contact you (and your data protection officer, if you have one).
2. Each purpose of processing and its legal basis (contract, consent, legal obligation, legitimate interest, with the interest named).
3. The recipients or categories of recipients: hosting, e-mail, analytics, advertising, payment.
4. Transfers outside the EU and the safeguard used.
5. How long each category of data is kept, or the criteria for deciding.
6. The rights of the person: access, rectification, erasure, restriction, objection, portability, withdrawal of consent.
7. The right to complain to a supervisory authority.
8. Whether providing the data is a legal or contractual requirement, and what happens if it is not provided.
9. Any automated decision-making with significant effects.

For California, add the categories of personal information collected, sold or shared in the last 12 months, the "Do Not Sell or Share" rights and how you respond to opt-out preference signals. The GDPR checklist shows where the policy fits among the other duties.

Is a cookie policy the same thing?

No, but they overlap. The privacy policy covers all personal data; the cookie policy lists the cookies and similar technologies, their purpose, provider and duration, and explains how to change consent. Many sites publish the cookie policy as a section of the privacy policy, which is fine as long as it is easy to find from the banner. How to write a cookie policy covers its contents.

Can I copy someone else's policy?

You can borrow structure, not facts. A copied policy names the wrong providers, retention periods and legal bases, and it may be someone's copyright. The worst policy is one that describes tools you do not use and omits the ones you do, because it shows authorities that nobody checked. Start from what your site actually does: scan it, list the tools, then write.

Where should it be linked?

From every page (usually the footer), from every form that collects data, from the cookie banner, and from account sign-up. Keep a date of last update at the top, and update it when you add a tool, a form or a provider.

Generating one from what your site does

Cookiequiet's generator writes a privacy policy, a cookie policy and terms from a questionnaire prefilled by a scan of your site, for the GDPR, UK GDPR, ePrivacy, CCPA/CPRA, LGPD and the Swiss FADP, in English and French. They are templates, not legal advice, and every page says so. The free plan covers one website with policies in one language; setup is one script tag before your other scripts, about five minutes from sign-up to a live banner. Start from the privacy policy generator.