How to create a privacy policy for your website

Open the site in a private browser window and use every path that collects information: forms, registration, checkout, comments, and support. Then inspect the administration settings for plugins, analytics, email, and hosting. Record what each feature receives and sends; a simple-looking page can still load several providers in the background.

• Forms: contact, quote, booking, newsletter, and job application forms, including hidden fields and file uploads.
• Accounts: registration, login, password reset, and profile pages.
• Analytics: Google Analytics, built-in builder analytics, heatmaps, and session recording.
• Cookies and local storage: what each one does and who sets it.
• Embeds: YouTube or Vimeo players, maps, social feeds, booking widgets, and chat bubbles.
• Hosting and security: server logs, content delivery networks, firewalls, and CAPTCHA tools.
• Email and marketing: newsletter platforms, CRMs, and advertising pixels.
• Payments: checkout pages, payment processors, and invoicing tools.

A quick technical check helps. Open your browser's developer tools, load a few pages in a private window, and look at the cookies, storage, and network requests. Every third-party domain you see is a provider your policy may need to mention.

Almost every website collects personal data, even when the owner never asks for it. Your host records IP addresses in server logs, analytics scripts set identifiers, and a single contact form collects names and email addresses. Several laws turn that into a duty to publish a privacy notice:

• GDPR and UK GDPR: Articles 13 and 14 list the information you must give people when you collect their data, and Article 12 requires it to be concise, transparent, and easily accessible.
• CalOPPA: commercial websites that collect personally identifiable information from California residents must conspicuously post a privacy policy.
• Other regimes: Canada, Australia, Brazil, and New Zealand all expect organizations to be open about how they handle personal information.

Platform terms add their own requirements. Google Analytics and Google AdSense both require an appropriate privacy policy before you use them. If you want the full picture of who must publish one, read do I need a privacy policy? and our guide to what happens if you don't have a privacy policy.

Turn the inventory into a simple table with five columns: what data, why you collect it, who receives it, how long you keep it, and, if the GDPR applies, which lawful basis you rely on. This table becomes the backbone of the policy.

A mini example for a small studio website:

• Contact form: name, email, message. Purpose: reply to the enquiry. Provider: your email host. Retention: 12 months after the conversation ends.
• Analytics: pages viewed, device type, approximate location from the IP address. Purpose: understand which pages work. Provider: your analytics vendor. Retention: the period set in the analytics settings.
• Newsletter: email address and sign-up date. Purpose: send updates the person asked for. Provider: your email marketing platform. Retention: until they unsubscribe.

Be specific about settings that change the answer, such as analytics retention, advertising features, or data sharing toggles. Our guide to analytics privacy disclosures shows which analytics settings change what you need to say.

Most website privacy policies follow the same skeleton, because the laws ask the same core questions. Use plain headings that a visitor can scan:

1. Who you are and how to contact you, including a privacy contact email.
2. What personal data you collect, grouped by source: forms, accounts, automatic collection, and third parties.
3. Why you use it, and the lawful basis where the GDPR or UK GDPR applies.
4. Cookies and similar technologies, with a way to change preferences.
5. Who receives the data: hosting, email, analytics, payment, and advertising providers.
6. International transfers and the safeguards you rely on.
7. How long you keep each category.
8. People's rights and how to exercise them.
9. Children's data, security, and how you announce changes.

Write in the active voice and say what you actually do. “We use Google Analytics to count page views” is clearer than “we may use various technologies.” The checklist in what should a privacy policy include? explains each section in more depth.

Regional sections are where many small websites go wrong, either by ignoring laws that apply or by copying sections for laws that do not.

• EU and UK visitors: if you offer goods or services to people in the EU or UK, or monitor their behavior, expect the GDPR or UK GDPR to apply. You need lawful bases, rights, transfers, and the right to complain to a supervisory authority. See the GDPR privacy policy guide.
• California: CalOPPA applies to commercial sites collecting personally identifiable information from California residents and requires, among other things, a statement about how you respond to Do Not Track signals. The CCPA only applies to businesses that meet its thresholds, such as an inflation-adjusted revenue threshold or handling the personal information of 100,000 or more California consumers or households. See the CCPA and CPRA guide.
• Other US states, Canada, Brazil, Australia, and New Zealand: each has its own triggers and terminology.

Only claim rights and obligations that apply to you. A policy that promises rights you never honor creates its own risk.

You have three realistic options, and each has a trade-off.

• Write it yourself: free and fully tailored, but slow, and easy to miss required statements such as transfer safeguards or Do Not Track wording.
• Copy another site's policy: fast but risky. Their practices, providers, and legal obligations are not yours, and the text is usually protected by copyright. We explain why in can I copy a privacy policy?
• Use a template or generator: quicker, as long as the tool asks about your real practices instead of filling blanks with generic promises.

The Website Privacy Policy Generator from Legal Policy Generator takes the third route. You answer plain questions about forms, analytics, tracking, providers, and regions. The tool then selects versioned clauses that match your answers, with no AI writing clauses at runtime. The questionnaire, full preview, and simple HTML and PDF download are free without an account. Advanced regional or optional modules cost $5. Whatever route you choose, the result is not legal advice, so review it against your actual setup.

Give the policy its own page with a short, stable address such as /privacy or /privacy-policy. A stable URL matters because you will paste it into app stores, ad platforms, email tools, and checkout settings, and a broken link there can stop a review.

The generic steps are the same on almost every platform:

1. Create a new page titled Privacy Policy.
2. Paste the policy text or HTML into the page body, or link to a hosted copy.
3. Add the effective date at the top so readers know which version they are reading.
4. Publish the page and open it in a private window to confirm it loads without a login.
5. Check that headings, lists, and links survived the paste.

With Legal Policy Generator, the simple HTML download can be pasted into a site builder page. If you would rather link to a public web page, optional hosting adds $0.99 once, and the $5 monthly subscription includes hosting while it is active. For platform-specific advice, read how to add a privacy policy to Wix, Squarespace, Webflow, or Shopify.

A policy nobody can find does little good. At minimum, place a link labelled Privacy Policy in the footer of every page, so it appears on the homepage and wherever a visitor lands.

Then add contextual links at each point of collection:

• Next to the submit button on contact, quote, and newsletter forms.
• On account registration and checkout pages.
• Inside your cookie banner or preference center, if you use one.
• In app store listings, ad platform settings, and OAuth consent screens that ask for a privacy policy URL.

Use plain link text, keep the link visible on mobile layouts, and make sure it works without JavaScript. Our guide on where to put a privacy policy link covers CalOPPA's “conspicuously post” wording and GDPR expectations in detail.

A privacy policy describes your website at one moment in time, and websites change constantly. Review the policy whenever one of these triggers happens:

• You add or remove a plugin, script, embed, or integration.
• You switch hosting, email, analytics, or payment providers.
• You start advertising, retargeting, or selling online.
• You begin serving visitors in a new country or region.
• A law you rely on changes, or a platform updates its terms.

Keep a dated copy of each version, change the effective date when the text changes, and tell people about material changes in a way that fits your relationship with them, such as a site notice or an email to account holders. A short review every few months, even when nothing seems to have changed, catches tools that teammates added quietly. Read how often should you update your privacy policy? for a practical review schedule.