Do You Need a Privacy Policy on Your Website? Yes, Here's Why

Published October 25, 2026 · Curbside Websites

Do you need a privacy policy on a small business website?

Yes, if your site collects any information from visitors. And it almost certainly does.

Most contractors think "collecting data" means running a store with credit cards. It doesn't. A contact form collects a name, email, and phone number. Google Analytics collects IP addresses and browsing behavior. A Facebook pixel collects enough to follow someone around the internet. A call tracking number records who called and when. Every one of those counts.

The only website that genuinely doesn't need a privacy policy is a single page with your phone number on it, no form, no analytics, no pixel, no chat widget, no email signup. That website basically doesn't exist anymore.

What actually triggers the requirement?

Here is the honest checklist. If any of these are true, write the policy:

• You have a contact or quote request form. Name, email, phone, address, job details. That's personal information.
• You use Google Analytics or any traffic stats tool beyond basic server logs.
• You have a tracking pixel from Google, Meta, or anyone else on the site.
• You use call tracking numbers or record calls.
• You have a chat widget or online booking tool.
• You collect emails for a newsletter or seasonal reminder list.
• You take payments or deposits through the site.
• You have a careers page where people submit applications.

A landscaper in a small town with a five-page site and one quote form hits at least three of these. That's the norm, not the exception.

Which laws actually apply to a one-truck operation?

This is where people get nervous, and mostly they shouldn't. There is no single federal law in the US that says every website needs a privacy policy. What exists is a patchwork:

• State privacy laws. California started it, and a growing list of states have followed. Most have revenue or data-volume thresholds that a local service business won't hit. But California's law has historically applied broadly enough that people play it safe.
• The platforms you already use. This is the one that actually bites. Google's terms for Analytics and advertising require you to post a privacy policy disclosing the use of cookies and data collection. Meta says the same thing for the pixel. You agreed to that when you installed the code.
• Text messaging rules. If you send appointment reminders or quote follow-ups by text, carriers require consent language on your form and a privacy policy link. Registration gets rejected without it. This trips up more contractors than anything else on this list.

So the practical answer: nobody from the state is auditing a painter's website. But Google can disapprove things, and a texting provider can refuse to register your number. That's reason enough.

What should a privacy policy for a small business website actually say?

Plain language, no legalese theater. It needs to cover:

1. What you collect. Name, email, phone, address, job details submitted through forms. Plus automatically collected data like IP address and pages viewed.
2. Why you collect it. To respond to quote requests, schedule work, send estimates, follow up.
3. Who you share it with. Your CRM, your email provider, your scheduling software, Google. You do not need to name every vendor, but say that you use third party service providers.
4. That you don't sell it. If that's true, say it clearly. Customers care about this more than any other line.
5. Cookies and tracking. Which tools you run and what they do.
6. How someone can ask you to delete their info. An email address is fine.
7. Contact info and a last-updated date.

The biggest mistake is a copied policy that describes a business you don't run. If your generated policy mentions shipping addresses and order history and you're an HVAC company, fix it. A policy that lies about what you collect is worse than no policy.

Do you need a lawyer, or is a generator fine?

For a standard service business site with a contact form and analytics, a generator is fine. There are free and cheap ones that ask what tools you use and produce something reasonable. Read it, edit the parts that don't match, and publish it.

Talk to an attorney if you:

• Process payments or store card information on your own site
• Collect health information, which can come up for certain restoration or home care work
• Take job applications and store resumes
• Operate across many states or have significant customer data volume

Everyone else is spending money on anxiety, not risk.

Where should the privacy policy link go?

In the footer, on every page. That's the convention and everyone knows to look there.

Add a second link right under your contact form button, small text, something like "By submitting this form you agree to our privacy policy." If you text customers, that line needs to also say they consent to receive texts and that message rates may apply.

You do not need a checkbox people have to tick. That adds friction to a form that's already asking a lot from a homeowner who just wants a price.

Do you need a cookie banner too?

Probably not. Those pop-ups come from European law. If your customers are homeowners within forty minutes of your shop, you are not serving EU visitors in any meaningful way, and a banner mostly just annoys people and hides your phone number on mobile.

California-focused businesses sometimes add a "Do Not Sell My Personal Information" link. If you don't sell data, you likely don't need it, and saying plainly in your policy that you don't sell data handles the question.

What else belongs alongside it?

Two things worth adding, both short:

• Terms of use. Covers the fact that info on your site isn't a binding quote and that your photos are yours. Low effort, occasionally useful.
• An accessibility statement. Optional, but a line saying you're working to keep the site usable for everyone and inviting people to contact you about problems costs nothing.

None of this wins you a job. It just keeps a dumb problem from showing up later. Spend twenty minutes, get it posted in the footer, and get back to the stuff that actually books work: your photos, your service pages, and your phone number being easy to find.

Common Questions

Can I copy another company's privacy policy?

Technically you can, and plenty of people do, but it is a bad idea. Their policy describes their tools and their data practices, not yours, and a policy that misstates what you collect is worse than having none. Use a generator and answer the questions honestly instead.

Does a one-page website need a privacy policy?

If that one page has a contact form, analytics, or a tracking pixel, yes. If it is nothing but your name, services, and a clickable phone number with no tracking at all, you can skip it, though that is rare these days.

Will I get fined if I don't have a privacy policy?

A fine from a state regulator is very unlikely for a small local contractor. The realistic consequences are platform-level: Google or Meta can flag your account, and texting providers will reject your number registration without a policy and consent language.

Does my Google Business Profile need a privacy policy?

No. Your profile itself does not require one. But the website you link from it does, since that is where the forms and tracking live.

How often should I update my privacy policy?

Whenever you add a new tool that collects data, like a chat widget, booking system, or a new tracking pixel. Otherwise a quick annual read-through is plenty. Update the date at the bottom when you change it.

Keep Reading

Does Nextdoor Bring In Jobs? Yes, but Not How You Think

Stop Paying for Your Website? Here's What Actually Disappears

Fake Google Review? Here's What Actually Gets It Removed