Do You Legally Need a Privacy Policy? A Practical Checklist

The threshold for needing a privacy policy is far lower than most site owners assume. It is not about running a shop or holding accounts. It is about whether any personal data is processed, and an IP address in a server log qualifies.

#The checklist

Answer yes to any of these and you need a published privacy policy:

• [ ] You have a contact form, newsletter signup or any form at all
• [ ] You run analytics of any kind, including privacy-focused tools
• [ ] You serve advertising, including AdSense
• [ ] You use cookies beyond strictly necessary session cookies
• [ ] You have user accounts or logins
• [ ] You take payments, even through a third-party processor
• [ ] You embed third-party content — YouTube, Maps, social widgets, fonts loaded from a CDN
• [ ] You have a mobile app on either app store
• [ ] Your hosting keeps server logs with IP addresses

Almost every website meets several of these. A completely static site with no analytics, no forms, no embeds and no ads might not — and that describes very few sites.

#Where the obligation comes from

Data protection law. GDPR requires a privacy notice for any processing of personal data of people in the EU or EEA, regardless of where your business is located. UK GDPR mirrors it. CCPA and CPRA apply to qualifying businesses handling data on California residents. Equivalents exist in Canada, Brazil, Australia, India, Japan, South Africa, and a growing number of US states.

Platform contracts. Google AdSense, Google Analytics, Apple's App Store and Google Play all contractually require a published privacy policy. This obligation is independent of the law and enforcement is immediate — accounts are suspended rather than warned.

Payment processors. Stripe, PayPal and every major processor require one in their acceptable use policies.

#What actually happens if you do not have one

Platform enforcement is the fastest. AdSense applications are rejected. Existing accounts get restricted. App submissions are declined. This happens within days, not years.

Regulatory action is slower but larger. Data protection authorities generally act on complaints rather than sweeps, but a single complaint from a visitor can trigger an audit, and a missing privacy notice signals broader non-compliance that invites deeper investigation.

Civil exposure varies. Some jurisdictions provide private rights of action for specific violations, and class actions over tracking without disclosure have become common in several US states.

For a small site, the realistic risk is platform enforcement and it is close to certain if you monetise.

#What the policy must actually contain

A privacy policy that does not describe your real practices is worse than none, because it evidences that you knew the obligation and misrepresented it. At minimum:

• Who you are and how to contact you about privacy
• What personal data you collect, by category
• Why you collect it, and the legal basis where GDPR applies
• Who you share it with, by recipient category
• How long you keep it
• What rights people have and how to exercise them
• Whether data is transferred internationally and under what mechanism
• How cookies and tracking are used

The privacy policy generator produces all of these, and only includes sections matching what you actually said you collect — a policy mentioning a mobile app you do not have is a signal nobody read it.

#The AdSense-specific requirements

If you serve Google advertising, three clauses are mandatory:

1. That third-party vendors, including Google, use cookies to serve ads based on prior visits to your site and others
2. That users can opt out via Google Ads Settings, or of third-party vendor cookies at aboutads.info
3. For EEA, UK and Swiss traffic, that consent is obtained through a Consent Management Platform under the Google EU user consent policy

Missing these is a common reason AdSense applications are rejected.

#A policy is not a cookie banner

These are separate obligations under separate law. The ePrivacy Directive governs cookies in the EU and UK and requires consent before non-essential cookies are set — including analytics and advertising.

You need both: a policy describing what you do, and a consent mechanism obtaining permission to do it.

#Where to publish it

At a stable URL such as /privacy-policy/, linked in your footer on every page, linked from every form near the submit button, referenced from your cookie banner, and linked in any app store listing. Never as a PDF and never behind a login.

#Keeping it true

A privacy policy describes practices, and practices change. Review it whenever you add an analytics tool, a support desk, an AI feature, a new processor or an advertising partner. Update the date, and give notice before material changes take effect.

Frequently asked questions