Do I need a privacy policy?

The short answer by situation

A site that runs a contact form, newsletter sign-up, analytics, advertising, embedded videos, accounts, or a checkout collects personal information and should publish a privacy policy. A mobile app distributed through Google Play or the Apple App Store needs one regardless of what it collects, because both stores require a policy link. A browser extension that handles user data needs one for the Chrome Web Store. Only a purely static page with no forms, no third-party embeds, no analytics, and server logs that are not retained or used to identify anyone may have a credible argument that no notice is legally required, and even then a short statement explaining that nothing is collected answers visitor and reviewer questions.

Laws that require a policy without a size threshold

California's Online Privacy Protection Act, Business and Professions Code section 22575, requires any operator of a commercial website or online service that collects personally identifiable information from California residents to conspicuously post a privacy policy, and it has no revenue or visitor threshold. Canada's PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in commercial activity and its openness principle expects information-handling policies to be available, again without a revenue test. Quebec's Law 25 has required businesses that collect personal information by technological means to publish a privacy policy in clear and simple terms since 22 September 2023. The EU and UK GDPR require specific information to be given to people whenever personal data is collected, whether or not the organization is small.

Laws with thresholds and exemptions

Some laws only apply above a threshold. The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet one of three tests: annual gross revenue above the CPI-adjusted figure, which has been 26,625,000 US dollars since 1 January 2025, buying, selling, or sharing the personal information of 100,000 or more consumers or households, or deriving at least half of annual revenue from selling or sharing personal information. Australia's Privacy Act generally exempts small businesses with annual turnover of 3 million Australian dollars or less, but not health service providers, businesses that trade in personal information, or several other listed categories. Other US state privacy laws use consumer-count thresholds that differ by state. Falling below one threshold rarely removes every obligation, because CalOPPA, platform rules, and other laws may still apply.

Platforms and providers require one by contract

Google Play states that all apps must post a privacy policy link in Play Console and within the app, and that apps that do not access personal and sensitive user data must still submit one. Apple requires a privacy policy link in App Store Connect and inside the app. The Chrome Web Store requires an accurate policy for any extension that handles user data. Google Analytics terms require an appropriate privacy policy, AdSense requires specific advertising-cookie disclosures, Mailchimp requires a publicly accessible privacy notice, and Google OAuth verification requires the policy link on your homepage. Breaking these terms can mean rejected releases, suspended accounts, or lost API access even where no regulator is involved.

Customers and partners ask for it

Business customers commonly review a vendor's privacy policy during procurement and security questionnaires, and payment providers expect merchants to describe how customer data is handled. A policy that accurately names your providers, retention approach, and request process shortens those reviews. A copied or obviously generic policy tends to create follow-up questions because reviewers compare it with what the product visibly does.

What the policy needs to cover

Once you know a policy is needed, the content follows from your facts: who operates the service and how to contact them, what information is collected and from where, why it is used, who receives it, whether it leaves the country, how long it is kept, how it is protected, whether children use the service, what rights people have and how to exercise them, and how changes are announced. Regional laws add their own items, such as legal bases under the GDPR, California categories and opt-out rights, or Do Not Track handling under CalOPPA.

How to decide quickly

List every place personal information enters your product: forms, accounts, checkout, support, analytics, advertising tags, embedded content, crash reporting, email tools, AI features, and server logs. Then list where your users are and which platforms distribute your product. If any entry appears on either list, prepare a policy. The Legal Policy Generator questionnaire walks through the same inventory and only activates clauses for the facts you confirm, so a small site receives a short policy and a complex app receives the regional and platform sections it actually needs.

Common questions