What happens if you don't have a privacy policy

Begin with what your product does today. List the collection points, correct any tracking that starts without required consent, and publish a notice describing the remaining data flows. Use the real publication date; a new policy does not retrospectively explain what people were told earlier. These steps help you address the gap and identify when legal advice is needed:

1. Inventory every form, account feature, analytics or advertising tag, SDK, and provider that touches personal information
2. Draft a policy that describes those facts accurately, including the regional sections your audience triggers
3. Check your consent setup so cookies and trackers that require consent are not firing before users agree
4. Publish the policy at a stable URL and link it from your footer, forms, app settings, and store listings
5. Update your App Store, Google Play, and other platform listings with the new link
6. Set an effective date and keep an archive so future versions are traceable
7. Get legal advice if you handle sensitive data or children's data, have received a complaint, or have been contacted by a regulator

The guide on how to write a privacy policy covers each step in depth. If you want a faster start, the Privacy Policy generator walks you through the same inventory and lets you preview the complete policy free, without an account.

There is no single worldwide law, but if you collect personal information online, at least one rule almost certainly applies to you. The main ones:

• GDPR and UK GDPR: apply to organisations established in the EU or UK and to those outside that offer goods or services to, or monitor the behaviour of, people there. Articles 13 and 14 require specific information when data is collected.
• CalOPPA: requires any operator of a commercial website or online service that collects personally identifiable information from California residents to conspicuously post a privacy policy, with no revenue threshold.
• CCPA: requires a detailed privacy policy from for-profit businesses that meet one of its thresholds, such as annual gross revenue above $26,625,000 as adjusted from 1 January 2025.
• Other US states and COPPA: many states have comprehensive privacy laws, and COPPA requires an online notice for services directed to children under 13.
• Canada, Brazil, Australia, New Zealand: PIPEDA, the LGPD, and the Australian and New Zealand Privacy Acts each require openness about how personal information is handled.

The do I need a privacy policy guide walks through each situation in more detail.

Yes, and this is often the first consequence developers meet. Apple's App Review guideline 5.1.1(i) states that all apps must include a link to their privacy policy in the App Store Connect metadata field and within the app in an easily accessible manner. Google Play's User Data policy says all apps must post a privacy policy link in Play Console and inside the app, and apps that do not access any personal and sensitive user data must still submit one.

Without a policy, a new submission is likely to be rejected, and an existing app can face enforcement during a later review. Google Play's enforcement can include rejection, removal, and suspension, and serious or repeated violations can put the developer account at risk. The policy must also be consistent with the privacy labels and Data safety form you submit.

If you are publishing a mobile app, the Google Play privacy policy and Apple App Store privacy policy guides list the exact requirements for each store.

Many tools you rely on make a privacy policy a contractual condition of using them. The Google Analytics terms, for example, require you to post a privacy policy that discloses your use of cookies, mobile identifiers, or similar technology, and to disclose your use of Google Analytics and how it collects and processes data. Advertising programs commonly require similar disclosures about cookies and ad personalisation, and email platforms expect senders to explain how subscriber data is used.

When you break a provider's terms, the provider can usually restrict, suspend, or terminate your access under those same terms. For a business that depends on ad revenue or a marketing list, losing an account can be more disruptive than a regulator's letter, because it happens without a hearing and can take time to reverse.

The fix is straightforward: disclose each tool you use in your policy, in the way its terms require. The guides on Google Analytics privacy policy and AdSense privacy policy requirements show the wording topics each provider expects.

Not every consequence comes from a regulator. Business customers routinely ask for a privacy policy during procurement and vendor security reviews. A missing policy, or one that clearly does not describe your product, raises questions that slow or stop deals, especially with larger customers that have their own privacy obligations.

Other practical effects are easy to underestimate:

• Partner and integration programs, such as sign-in with Google or browser extension stores, often require a policy URL before approval
• Payment, email, and marketing providers expect merchants to explain how customer data is handled
• Investors and acquirers review privacy documentation during due diligence
• Users increasingly look for a privacy link before handing over an email address or card number

None of these comes with a fine, but each can cost more in lost revenue and delays than the time needed to publish an accurate policy. A clear, honest policy is also a quiet trust signal on every page of your site.

The GDPR treats transparency as a core obligation. Under Article 83(5), infringements of the data subject rights provisions in Articles 12 to 22, which include the information you must give people, can lead to administrative fines of up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. The UK GDPR sets the equivalent maximum at £17.5 million or 4%.

Those are ceilings, not starting points. Article 83(2) requires authorities to consider the nature, gravity, and duration of the infringement, the number of people affected, whether it was intentional or negligent, the steps taken to reduce harm, and the organisation's cooperation. Fines must be effective, proportionate, and dissuasive.

Fines are also not the only tool. Under Article 58, supervisory authorities can issue warnings and reprimands, order you to bring processing into line with the GDPR, order you to communicate information to the people concerned, and impose temporary or definitive limitations on processing, including a ban. For a small business, an order to stop a marketing practice can matter more than the theoretical maximum fine.

California has two overlapping regimes. The CCPA applies to for-profit businesses that do business in California and meet a threshold, such as annual gross revenue above $26,625,000, buying, selling, or sharing the personal information of 100,000 or more consumers or households, or earning at least half of annual revenue from selling or sharing personal information. After the January 2025 adjustment announced by the California Privacy Protection Agency, administrative fines and civil penalties can reach $2,663 per violation or $7,988 per intentional violation or violation involving the personal information of consumers the business knows are under 16. The Agency enforces administratively and the Attorney General can bring civil actions.

CalOPPA has no size threshold. An operator violates it if it fails to post a compliant policy within 30 days after being notified of noncompliance. CalOPPA contains no penalty amounts of its own, but violations can be pursued under California's Unfair Competition Law, where civil penalties can reach $2,500 per violation under Business and Professions Code section 17206.

Per-violation amounts add up quickly when they are counted per user or per download. The CCPA and CPRA guide explains what the California disclosures must contain.

The United States has no general federal law that requires every business to publish a privacy policy. However, the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in commerce, and the FTC has used that power for many years against companies whose privacy statements were misleading or whose practices broke promises they made. Settlements commonly impose long-term obligations, such as privacy programs, independent assessments, and reporting, and violating an FTC order can lead to civil penalties.

Children's services face a stricter rule. The COPPA Rule requires operators of websites and online services directed to children under 13, or with actual knowledge that they collect personal information from such children, to post an online privacy notice and obtain verifiable parental consent. According to the FTC's COPPA guidance, a court can hold violators liable for civil penalties of up to $53,088 per violation, a figure adjusted for inflation.

The lesson is that both silence and inaccuracy carry risk. Not having a policy does not avoid FTC scrutiny if your practices are unfair, and a policy that says the wrong thing creates a deception problem of its own.

If your users are in these countries, their laws also expect openness about data handling:

• Canada: PIPEDA's openness principle requires organisations to make information about their policies and practices readily available. The Office of the Privacy Commissioner investigates complaints, and Quebec's Law 25 adds its own publication duties.
• Brazil: the LGPD gives people the right to clear information about processing. Its sanctions include warnings and fines of up to 2% of a company's revenue in Brazil, limited to R$50 million per infraction.
• Australia: entities covered by the Privacy Act, generally businesses with annual turnover above A$3 million plus some smaller ones, must have a clearly expressed and up-to-date privacy policy under APP 1. The OAIC can investigate and seek civil penalties for serious interferences with privacy.
• New Zealand: the Privacy Act 2020 requires agencies to tell people about collection, and the Privacy Commissioner can investigate complaints and issue compliance notices.

Details differ, so check the privacy laws hub for each country you serve.