#Why you almost certainly need one
A privacy policy is not optional for a modern website, and the obligation comes from three independent directions.
The law. GDPR requires a privacy notice for any site processing personal data of people in the EU or EEA — and an IP address in a server log is personal data. UK GDPR mirrors it. CCPA and CPRA apply to qualifying businesses handling data on California residents. Equivalent regimes now exist in Canada, Brazil, Australia, India, Japan, South Africa and a growing list of US states.
Your platform contracts. Google AdSense, Google Analytics, Apple's App Store and Google Play all contractually require a published privacy policy. Non-compliance means removal, not a warning.
Your payment processors. Stripe, PayPal and every major processor require one in their acceptable use terms.
The practical threshold is very low: if you run analytics, an email signup, a contact form or advertising, you need a policy.
#What this generator produces
The questionnaire drives which clauses appear. Tick advertising and you get the Google-required advertising disclosures plus the EEA consent language. Tick payment data and you get the processor clause. Leave something untouched and its section does not appear at all.
That conditional structure matters, because a policy claiming you collect data you do not collect is itself a misrepresentation — and a boilerplate template that mentions "our mobile application" when you have no app signals to a regulator that nobody read it.
The output covers:
- Identity of the controller and contact route for privacy requests
- Categories of data collected, with the purpose of each
- Legal bases for processing under GDPR
- Cookies and tracking, including third-party advertising disclosures
- Recipients and processor categories, in table form
- International transfer mechanisms
- Retention periods
- Data subject rights under GDPR, CCPA/CPRA and, where selected, PIPEDA and LGPD
- Children's data
- Security measures, Do Not Track and change notification
#The AdSense-specific requirements
If you serve Google advertising, your policy must state three things. All three are included when you tick advertising:
- That third-party vendors, including Google, use cookies to serve ads based on prior visits to your site and other sites
- That users can opt out of personalised advertising via Google Ads Settings, or third-party vendor cookies via aboutads.info
- For EEA, UK and Swiss traffic, that you obtain consent through a Consent Management Platform in line with the Google EU user consent policy
Failing to include these is one of the more common reasons AdSense applications are rejected or accounts are later restricted.
#A privacy policy is not a cookie banner
These are separate obligations and satisfying one does not satisfy the other.
The ePrivacy Directive — which sits alongside GDPR and is what actually governs cookies in the EU and UK — requires consent before any non-essential cookie is set. That includes analytics and advertising cookies. Consent must be:
- Obtained before the cookie is written, not after
- As easy to refuse as to give (no dark-pattern "Accept all" with a hidden reject)
- Granular by purpose
- Logged, so you can demonstrate it
- Withdrawable at any time
A privacy policy describes what you do. A consent banner is the mechanism by which you obtain permission to do it. You need both.
#Where to publish it
- At a stable, permanent URL such as
/privacy-policy/— never a PDF, never behind a login - Linked in your site footer on every page
- Linked from every signup form and checkout, next to the submit button
- Linked in your app store listing, if you have an app
- Referenced from your cookie banner
#Keeping it accurate
A privacy policy is a description of your actual data practices, and it stops being true the moment those practices change. Review it whenever you add an analytics tool, a new processor, an AI feature, a support desk, or a new advertising partner. Update the "last updated" date, and give notice before material changes take effect.
#What this generator is not
It is a well-structured starting point built from standard clauses, not legal advice, and it does not create a lawyer-client relationship. If you process health data, financial account data, biometric data, or data on children, or you operate in a regulated sector such as healthcare, finance or insurance, have a qualified lawyer review the document before you publish it. The cost of that review is trivial next to a regulatory finding.