Where to put your privacy policy link on a website

Add a link labelled Privacy Policy to the shared footer component so it appears on ordinary pages and campaign landing pages. Point it directly to the policy, rather than a general legal page that requires more searching. Then add links at the collection points discussed below. Check these details when implementing the footer:

Footer link checklist:

• Use the plain label Privacy Policy rather than a vague word like Legal.
• Put it in a shared footer template so new pages inherit it automatically.
• Make it a real HTML link that works without JavaScript and is not hidden behind a menu that only opens on hover.
• Give it enough contrast and size to read, and a touch target large enough to tap on a phone.
• Keep the URL stable, so links in old emails and platform settings keep working.

Some platform terms expect notice wherever their code runs. Meta's Business Tools Terms, for example, require a clear and prominent notice on each web page where Meta pixels are used, which a site-wide footer link to a policy covering the pixel helps you provide. See our guide to Facebook lead ads and Meta Pixel disclosures.

A privacy policy only does its job if people can find it at the moment they decide whether to share their data. Laws and platform rules reflect that. They rarely tell you the exact pixel position of a link, but they do set standards such as “conspicuously post”, “easily accessible”, and “at the time when personal data are obtained”.

Good placement serves three audiences at once:

• Visitors, who want to check what happens to their email address before pressing submit.
• Regulators, who look at whether information was available when it mattered, not just somewhere on the site.
• Platform reviewers, such as app store and ad platform teams, who check that your privacy policy URL works and matches your product.

Placement cannot fix an inaccurate policy, though. Make sure the document itself is complete first, using our guide on what a privacy policy should include, and then put the link everywhere it belongs.

The California Online Privacy Protection Act requires operators of commercial websites and online services that collect personally identifiable information from California residents to conspicuously post a privacy policy. Section 22577 of the Business and Professions Code defines what counts. For websites, the options include:

• Posting the policy itself on the homepage or the first significant page after entering the site.
• An icon that links to the policy, placed on the homepage or first significant page, that contains the word “privacy” and uses a color that contrasts with the background.
• A text link on the homepage or first significant page that includes the word “privacy” and stands out from surrounding text, for example through larger type, capitals, or a contrasting font or color.
• Any other functional hyperlink displayed so that a reasonable person would notice it.

For online services such as apps, the policy can be made available through any other reasonably accessible means.

A footer link labelled Privacy Policy on every page, in readable contrast, is the common way to meet this. The CalOPPA privacy policy generator covers the required contents, including the Do Not Track statement.

The GDPR focuses on timing and accessibility rather than a specific spot on the page. Article 13 requires you to give the listed information at the time when personal data are obtained from the person. Article 12 requires it to be concise, transparent, intelligible, and in an easily accessible form.

European transparency guidance, originally adopted by the Article 29 Working Party and endorsed by the European Data Protection Board, adds practical detail:

• The privacy statement should be clearly visible on each page of a website under a commonly used term such as Privacy, Privacy Policy, or Data Protection Notice.
• In apps, the information should never be more than two taps away.
• A layered approach works well: a short notice where data is collected, with a link to the full policy.

So under the GDPR, a footer link is the baseline, and a short just-in-time notice next to each form is what puts the information in front of people when it matters. The GDPR privacy policy guide covers the contents Articles 13 and 14 require.

Forms are where the GDPR's point-of-collection rule bites hardest. A visitor filling in a form should not need to scroll to the footer to understand what happens next. Add one or two short sentences right above or below the submit button.

A mini example for a contact form:

“We use your name, email, and message to reply to your enquiry and keep the conversation for 12 months. See our Privacy Policy for details and your rights.”

Make Privacy Policy a link to the full document. For a newsletter box, say what you will send and how often, and that people can unsubscribe at any time.

Avoid pre-ticked boxes, and do not bundle marketing consent into a checkbox that people must tick to send a message. If you ask for marketing consent, use a separate, unticked checkbox. Our guide to contact form privacy notices has more wording examples and explains which lawful basis usually applies.

Checkout and registration pages collect the most data in one go, so they need the link most.

• Checkout: place links to the privacy policy and terms near the order button. Payment pages hosted by a provider usually let you add your own policy and terms links in settings.
• Account sign-up: link the privacy policy next to the create account button, and keep any marketing opt-in separate from accepting the terms.
• Cookie banners: link the full policy or cookie section from the banner itself, and give people a persistent way to reopen their cookie settings later, often a footer link next to the privacy policy.

If you sell online, your terms of sale and your privacy policy do different jobs, so link both rather than merging them. Our comparison of privacy policy vs terms and conditions explains the difference, and do you need a cookie banner? covers when consent is required.

Mobile apps and platform integrations have their own link requirements, and reviewers check them.

• Google Play: the User Data policy requires a privacy policy link in the designated field in Play Console and within the app itself.
• Apple App Store: App Review Guideline 5.1.1 requires a privacy policy link in App Store Connect metadata and within the app in an easily accessible manner.
• Meta, Google OAuth, and Chrome Web Store: developer dashboards and review processes ask for a public privacy policy URL.
• Ad platforms: lead form tools ask for your privacy policy URL so people can read it before they submit.

All of these need a stable, public URL that loads without a login. If your app has no website, a hosted policy page solves the problem; our guide on how to get a privacy policy URL explains the options. For Android specifics, see Google Play privacy policy requirements.

Accessibility is part of being easily accessible. A link that some visitors cannot see, reach, or understand fails the people the policy is meant for.

• Descriptive text: use Privacy Policy as the link text, not an icon alone or a phrase like click here.
• Keyboard and focus: make sure the link can be reached with the Tab key and shows a visible focus indicator.
• Contrast and size: footer text is often styled too faint. Keep it readable against the background.
• Touch targets: give links enough space on mobile so they are easy to tap.
• Readable document: the policy page itself should use real headings, short paragraphs, and lists, so screen reader users can jump between sections.
• Language: if your site is available in several languages, link to the policy in the language the visitor is using where you can.

These steps also help the reasonable person standard in CalOPPA: a link that is easy to see and use is a link people notice.