✧ Key takeaways
A privacy policy is not legal decoration. Here is what a small website must include, a free template to copy, and the mistakes to avoid.
Most small websites collect personal data without ever thinking about it. Google Analytics logs IP addresses. A contact form collects names and email addresses. An email signup stores subscribers. Ad networks drop cookies. Every one of those is personal data under modern privacy law — and that is why your site needs a privacy policy, even if it gets forty visitors a month.
This is not a legal lecture. It is a practical guide: what the policy has to say, how to write it in plain language, and a template you can copy and adapt. One warning up front — this article is general information, not legal advice. If your site handles health data, children's data, or operates in a regulated industry, pay a lawyer to review your policy.
Do you actually need one?
Short answer: almost certainly yes. Three separate reasons point the same way. First, the law. The GDPR applies if you have visitors from the EU, no matter where your business sits. California's CCPA and similar laws cover their own residents. These laws do not have a small-site exemption. Second, the platforms. Google AdSense requires a privacy policy before it will approve your site for ads, and analytics and ad tools expect one as a condition of use. Third, trust. Visitors who are deciding whether to hand you their email address will check. A site with no policy looks unfinished.
The only sites that can plausibly skip one are pure static pages with no analytics, no forms, no comments, no ads, and no cookies. If that describes your site, congratulations — and check again, because most hosting setups add analytics or logs you forgot about.
What a privacy policy has to cover
A policy is a description of reality, not a piece of marketing. Each section answers one question a visitor or a regulator would ask.
1. Who you are
Your site name, the business or person behind it, and a contact email for privacy questions. If you have a business address, include it. Anonymous policies are not policies.
2. What data you collect
Be specific. List it: names and email addresses from forms, IP addresses and browser data from analytics, cookies from ad networks, payment details if you sell anything. Vague phrases like 'we may collect certain information' tell the reader nothing and protect you from nothing.
3. Why you collect it
Every item of data needs a purpose: analytics to understand traffic, email addresses to send a newsletter, cookies to serve relevant ads. If you cannot name the purpose, you probably should not be collecting it.
4. Cookies and tracking
Name the tools: Google Analytics, Google AdSense, your email provider, any social embeds. Explain what each does in one line. If you run ads, say so plainly — visitors are far more forgiving of tracking they were told about than tracking they discover.
5. Who you share data with
Your analytics provider, your email provider, your ad network, your hosting company. Link to their privacy policies where you can. If you sell data, say so — and expect readers to leave. Most small sites share data only with service providers, and saying that clearly is a strength.
6. How long you keep it
Give retention periods: analytics data for 14 months, email subscribers until they unsubscribe, contact form messages for one year. 'We keep data as long as necessary' is the sentence everyone writes and nobody can act on. Put a number on it.
7. Visitor rights
Under the GDPR, visitors can ask what you hold about them, ask you to correct it, or ask you to delete it. Under the CCPA, Californians can ask what you collected and request deletion. Name the rights, and give the email address where requests go.
8. Children, changes, and contact
State whether your site is aimed at children — for most sites, it is not, and you should say so. Explain that you will update the policy when practices change, and date the document. An undated policy is a policy nobody maintains.
How to write it: five steps
Step 1: audit your site. Open your site and list every tool that touches visitor data: analytics, ads, forms, comments, email signup, social embeds, payment buttons, chat widgets. Check your hosting dashboard too — server logs count.
Step 2: list your third parties. For each tool, note the company name and a link to its privacy policy. These become the 'who we share data with' section.
Step 3: draft in plain language. Write the policy the way you would explain it to a friend. Short sentences. No legal filler. If a sentence would confuse your least technical reader, rewrite it.
Step 4: use the template below as the skeleton. Fill in every bracket, delete the sections that do not apply, and do not keep a section you cannot honestly stand behind.
Step 5: publish and link it. Create a page at /privacy-policy, link it in the footer of every page, and add it to your AdSense application. Then put a yearly reminder in your calendar to review it.
Free privacy policy template
Copy the text below, replace everything in [brackets], and delete what does not apply. This template covers a typical small content site — adjust it to match your tools.
Privacy Policy for [Your Site Name]
Last updated: [Date]
[Your Site Name] ('we', 'us') operates [your site URL]. This policy explains what personal data we collect, why we collect it, and what rights you have. Contact us at [privacy email] with any questions.
Data we collect. When you visit, we collect [IP address, browser type, and pages visited] through [Google Analytics]. When you use our contact form, we collect [your name and email address]. When you subscribe, we collect [your email address] through [email provider].
How we use it. We use analytics data to understand which content readers find useful. We use contact details to reply to your messages. We use email addresses to send the newsletter you signed up for. We do not sell your personal data.
Cookies. We use cookies for [analytics and advertising]. [Google AdSense] may use cookies to serve ads based on your browsing. You can disable cookies in your browser settings.
Third parties. We share data with [Google Analytics, Google AdSense, and your email provider] so they can provide their services. Their privacy policies govern their use of that data.
Retention. Analytics data is kept for [14 months]. Contact form messages are kept for [12 months]. Email addresses are kept until you unsubscribe.
Your rights. Depending on where you live, you may request access to, correction of, or deletion of your personal data. Email [privacy email] and we will respond within [30 days].
Children. This site is not directed at children under [13/16], and we do not knowingly collect their data.
Changes. We will update this policy when our practices change and post the new version here.
Mistakes that get sites in trouble
Copying a big site's policy word for word. Google's privacy policy describes Google's data practices, not yours. A copied policy that names tools you do not use is easy to spot and impossible to defend.
Writing it once and forgetting it. Add an ad network in March, and your policy from January is now wrong. Treat the policy as a living document — review it whenever your tool stack changes.
Hiding the link. A privacy policy linked only from a subpage fails the basic test: can a visitor find it in five seconds? Footer, every page.
Claiming compliance you do not have. Do not write 'we are GDPR compliant' because a template said so. Describe what you actually do. Honest description beats confident claims.
What happens if you do not have one?
Three things, in rough order of likelihood. First, AdSense rejects your application or suspends your account — a missing or thin privacy policy is one of the most common reasons small sites fail the review, and it is also one of the easiest to fix. Second, you lose readers. People are more careful with their data than they were five years ago, and a site that asks for an email address while offering no policy looks careless at best. Third, regulators. Fines make the headlines, but for a small site the realistic risk is a complaint from a visitor or a warning letter — both of which start with someone reading your policy and finding it absent. None of these outcomes requires bad intent. They only require a site that collects data and never explains itself.
The fix costs an afternoon and a template. There is no version of this where waiting helps: the longer your site runs without a policy, the more data practices you have to document when you finally write one.
The bottom line
A privacy policy is a one-afternoon job for a small site: audit your tools, fill in the template, publish it, link it in the footer. It keeps you on the right side of the law, it is required for AdSense approval, and it signals to visitors that you take their data seriously. Do it now, while your site is small — it only gets harder to write honestly as the tool stack grows.
If you are preparing your site for AdSense, read our guide to E-E-A-T and AdSense approval next, and if you are still setting the site up, the complete beginner's guide to starting a website in 2026 covers the foundations. For the broader picture of staying safe online, see our online privacy guide.