Website Privacy Policies: What Small Businesses Should Review

When was the last time anyone looked at your website's privacy policy? For most business owners, the honest answer is never. It came with the website, or it was copied from a template years ago, and it hasn't been touched since. 

Privacy laws across the US and around the world have changed what websites need to disclose, and those rules may apply to small businesses far sooner than most owners expect.  

This article walks through why privacy laws are changing, and what a current policy should include. To be upfront: we're a web partner, not a law firm. This is informational content, and for legal questions, an attorney is the right call. 

Why Website Privacy Laws Are Changing 

If privacy policies never seemed urgent before, that's because the rules used to be looser. The landscape has shifted, and it's still shifting. 

State Privacy Laws Are Expanding Beyond California 

California led the way with the California Consumer Privacy Act (CCPA). This privacy act requires businesses to tell California residents what personal information they collect, why they collect it, and who they share it with. 

A growing list of states has followed with privacy laws of their own, and each one sets similar rules for what visitors need to be told. What catches people off guard is that these laws often apply based on where your visitors live, not where your business sits. This means that your customers don't have to be in California for California's rules to reach you.  

If your website draws visitors from across the country, more of these laws touch your business than you might think. 

International Privacy Regulations Like GDPR Apply Too 

If your business actively serves customers outside the US, international regulations may apply as well. Europe's General Data Protection Regulation, known as the GDPR, has been in effect since 2018 and asks more of businesses than most US laws do. A helpful starting point is GDPR.eu, a plain-language resource written with small business owners in mind. 

Privacy Law Is Still Taking Shape 

This area of law is new and still developing, and we'll be upfront: we aren't lawyers, and this isn't legal advice. What we can tell you from the web side is that an outdated, inaccurate, or missing privacy policy puts your business in a worse position than one that reflects reality. When the rules are moving, accuracy is your safest starting point. 

What Your Website Collects Without You Realizing It 

Most business owners assume a privacy policy is only for companies that ask for sensitive information. In reality, the standard tools on almost every website are already collecting visitor data. 

Google Analytics Collects Visitor Data 

If Google Analytics runs on your website, it may be gathering technical information about every visitor. That could include details like their IP address and browser type, along with which pages they view and how long they stay. 

Most owners never think of analytics as data collection. It is, and your privacy policy needs to say so. 

Contact Forms Collect Personal Information 

Every time a prospective customer fills out your contact form, you're collecting their name and email, plus a phone number and whatever else they choose to share. That's exactly the kind of information privacy policies exist to address. Your policy needs to explain how you use it, whether that's responding to inquiries or following up later. 

Cookies and Tracking Technologies Store Visitor Data 

Cookies and similar tracking tools help your website function and show you how visitors use it. They also store information on your visitors' devices. Your policy needs to communicate that, along with how visitors can control it. 

Privacy Policy Requirements Your Website Needs to Meet 

So what does a current, accurate policy actually look like? A few pieces come up again and again across the newer laws. 

The Data You Collect and How You Use It 

A solid policy plainly explains what information your website gathers. That covers what visitors hand you directly and what gets collected automatically in the background, along with what your business does with all of it. 

If your policy doesn't match what your website actually does, that gap is the problem. A template from 2018 has no idea what tools your site runs today. 

Third-Party Services That Access Visitor Information 

Your website doesn't run in isolation. Hosting providers, analytics tools, and payment processors all touch your visitors' information as part of keeping things working. A current policy names these kinds of relationships, so visitors know who else is involved with their data. 

A Way for Visitors to Contact You About Their Data 

Newer privacy laws emphasize giving people ways to access, correct, or ask about their information. Your policy needs a clear path for visitors to reach you with those requests, and your business needs to be ready to respond when they do.  

Update Your Privacy Policy with Legend 

If you're reading this and realizing you can't remember the last time anyone looked at your privacy policy, you're not alone. Many businesses are navigating this right now. 

We keep our clients' websites current, and that includes making sure the privacy policy reflects what the site actually collects and how it's used.  

For legal questions, we'll always point you to an attorney. For your website itself, we can help! Let's take a look at your privacy policy stand! Reach out at support@legendwebworks.com!