Does a small business website need a privacy policy?

Yes, in practice. If your site has a contact form, a quote form, or Google Analytics, it collects information about people, and at least one state law and one set of terms you have already agreed to say you must post a privacy policy. Here is what each one actually says. This is not legal advice; it is the text of the rules, and a lawyer is the person to ask about your own case.

The law most sites fall under is California's

California's Online Privacy Protection Act is the statute that reaches a plumber in Colonie. The reach is written by where the visitor lives, not where the business is. The text:

"An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site" (Source: Cal. Bus. and Prof. Code 22575(a)).

An "operator" is any person or entity that owns a commercial website that "collects and maintains personally identifiable information from a consumer residing in California" (Source: Cal. Bus. and Prof. Code 22577(c)). The statute's list of personally identifiable information includes a first and last name, a home or other physical address, an email address, and a telephone number (Source: Cal. Bus. and Prof. Code 22577(a)). A contact form collects at least two of those from whoever fills it in, and a form on the public internet can be filled in from anywhere.

The statute also says what the policy has to contain (Source: Cal. Bus. and Prof. Code 22575(b)):

• the categories of information collected and the third parties it may be shared with
• how a person can review and request changes to their information, if you offer that
• how you tell people about changes to the policy
• the effective date
• how the site responds to "do not track" signals
• whether third parties may collect information about a visitor's activity across other sites

That is one short page. Most of a trade site's answers are a sentence each.

What New York requires

We did not find a New York statute that tells a general business website to post a privacy policy. What New York has is two sections of the General Business Law about the data itself.

Section 899-bb, the SHIELD Act, says: "Any person or business that owns or licenses computerized data which includes private information of a resident of New York shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information including, but not limited to, disposal of data" (Source: NY GBL 899-bb(2)(a)). It defines a small business as one with fewer than fifty employees, under three million dollars in gross annual revenue in each of the last three years, or under five million dollars in year-end assets, and says a small business complies when its safeguards "are appropriate for the size and complexity of the small business, the nature and scope of the small business's activities, and the sensitivity of the personal information the small business collects" (Source: NY GBL 899-bb(1)(c) and (2)(c)).

Section 899-aa is the Information Security Breach and Notification Act. If private information is accessed or acquired by someone without authorization, the business "shall disclose any breach of the security of the system" to every New York resident affected, "in the most expedient time possible and without unreasonable delay," and within thirty days of discovering it (Source: NY GBL 899-aa(2)). Private information there means personal information combined with items like a social security number, a driver's license number, financial account credentials, or "a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account" (Source: NY GBL 899-aa(1)(b)).

So New York's rules are about what you do with the data. A privacy page is where you tell people what that is, and writing it is the moment most owners find out which tools on their site are collecting what.

Google's own terms require one

If Google Analytics is on your site, you agreed to its terms when it was installed. Section 7 says: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies, identifiers for mobile devices (e.g., Android Advertising Identifier or Advertising Identifier for iOS) or similar technology used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data" (Source: Google Analytics Terms of Service, section 7). Other tools you add, a form service, a chat widget, a call-tracking number, carry terms of their own; read each one.

Say what you do, then do it

The federal rule is about honesty. The FTC's guidance for businesses says that a company which makes privacy promises, expressly or by implication, must live up to them under the FTC Act (Source: FTC business guidance). A policy copied from a bigger company that promises things you do not do is worse than a short one that is true. If your form goes to a third-party form service and then to your Gmail, say that.

Check yours from a phone

1. Open your site and scroll to the footer. Is there a Privacy link at all?
2. Tap it. Does the page name the form tool and the analytics you actually use?
3. Is there an effective date, and is it real?
4. Under your contact form, is there a line that says where the message goes?

If the answer to the first question is no, you are not alone; in our September audit of Capital Region business sites most had no privacy page. The counts are in the audit post, with their caveats.

What we do on every build

Every site we build carries a privacy page written from the tools actually on the site, a consent line under every form that says where the message goes and links to the policy, and an effective date set once at launch, never defaulted to the day the page was rendered. It is part of the build, not an extra. See what every package includes at /build.