Do You Need a Privacy Policy on Your Website? (2026)

This guide covers what applies in 2026, from US state law to the EU and UK, and the part most owners miss: a privacy policy has to stay true after you publish it. ConsentStack makes a privacy policy generator, so weigh that as you read. Every legal rule below links to its source.

Who needs a privacy policy?

Any one of these is enough on its own:

Why is everyone updating their privacy policy in 2026?

Because the map changed. Three state privacy laws took effect on January 1, 2026, in Indiana, Kentucky and Rhode Island, which brings the number of states with a comprehensive privacy law in force to 20. On July 1, 2026, Connecticut extended its law to businesses that handle the data of 35,000 Connecticut consumers, to any business that processes sensitive data and to any business that offers personal data for sale. More are on the way: Oklahoma and Louisiana on January 1, 2027, Alabama on May 1, 2027 and Vermont on January 1, 2028.

For a lot of sites, though, the bigger change isn't the law. It's the site. A new ad pixel, booking widget or chat tool changes what you collect and who receives it, and the policy you published last year doesn't know about it. More on that below.

What US law requires

California's online privacy law covers almost every business site

CalOPPA applies to "an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California", wherever the business is based and however small it is. That operator "shall conspicuously post its privacy policy" (Bus. & Prof. Code 22575). Personally identifiable information includes a first and last name, a home or other physical address, an email address and a phone number (22577), so a single contact form or newsletter signup from a California visitor brings you in.

The policy has to identify the categories of personal information you collect and the categories of third parties you share it with, describe how visitors can review and correct their information if you offer that, explain how you announce material changes, show its effective date, say how you respond to Do Not Track signals, and say whether other companies can collect information about a visitor's activity over time and across sites through yours. Enforcement starts with a notice: an operator is in violation only if it fails to post its policy within 30 days of being told it is out of compliance.

The state privacy laws, and who they cover

The 20 comprehensive state laws each require a business they cover to publish a privacy notice describing what it collects, why, who it shares data with and how people exercise their rights. Most apply only above a threshold. A common one is controlling or processing the personal data of 100,000 state residents in a year, and several states set it lower: 35,000 in Delaware, New Hampshire, Maryland, Rhode Island and now Connecticut, and 25,000 in Montana.

Two states have no numeric threshold at all. Texas applies to any business that operates there or serves Texas residents, processes or sells personal data and is not a small business as the US Small Business Administration defines it (Bus. & Com. Code 541.002). Nebraska works the same way. California's CCPA applies to businesses with annual revenue above $26,625,000 (the CPI-adjusted figure since January 1, 2025), businesses that buy, sell or share the personal information of 100,000 or more consumers or households a year, and businesses that earn half their revenue from selling or sharing it. Sharing, under the CCPA, means disclosing data for cross-context behavioral advertising.

Rhode Island's rule for websites, since January 1, 2026

Rhode Island added a duty aimed squarely at websites, with no size threshold. Any commercial website that does business in Rhode Island or has customers there and sells customers' personal information has to identify the categories of personal data it collects, every third party it has sold or may sell that information to, and an email address or other way to contact it. And under 6-48.1-3(b), a business that sells personal data or processes it for targeted advertising "shall clearly and conspicuously disclose such processing". A small online shop that retargets visitors with an ad pixel and sells to Rhode Islanders is likely covered by that second rule.

A wrong privacy policy is its own problem

Publishing a policy doesn't end the job. The Federal Trade Commission treats privacy statements a business doesn't live up to as deceptive practices under Section 5 of the FTC Act: in 2012, Google paid $22.5 million to settle FTC charges that it misrepresented privacy assurances to users of Apple's Safari browser. Our cookie and pixel court cases guide covers what has happened since.

The tools on your site require one too

Even where no law reaches you, the tools you install do. Google Analytics' terms are blunt: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies, identifiers for mobile devices ... or similar technology used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data" (Google Analytics terms).

The Meta Pixel goes further. Meta's Business Tools Terms require, for websites, "a clear and prominent notice on each web page where our pixels are used" that links to an explanation that you use pixels and similar technologies from third parties including Meta, how visitors can opt out of the use of their information for ad targeting, and where they can make that choice (Meta Business Tools Terms). That is why a privacy link belongs on every page, not just the homepage.

Selling to Europe or the UK?

The GDPR applies to businesses outside the EU when they offer goods or services to people in the EU or monitor their behavior there (Article 3(2)). When you collect personal data, Article 13 requires you to tell people who you are and how to contact you, why you are processing their data and on what legal basis, who receives it, whether it leaves the EU, how long you keep it, what rights they have, including the right to withdraw consent and to complain to a regulator. The UK GDPR keeps the same notice duties. Canada's PIPEDA and Australia's Privacy Act set their own notice rules.

What your privacy policy has to say

Put the requirements above together and a privacy policy that works across the US, the EU and the UK covers these:

• Who you are, and how to contact you about privacy
• What personal information you collect, including through cookies and tracking tools
• Why you collect it, and under the GDPR, the legal basis for each use
• Who you share it with: categories at minimum, and the tools you run by name where their terms ask for it, as Google Analytics' do
• Whether you sell personal information or use it for targeted advertising
• How long you keep it
• People's rights and how to exercise them
• How you respond to Do Not Track signals, and whether you honor Global Privacy Control
• Whether other companies can track visitors across sites through yours
• How you announce changes, and the date the policy took effect

The part most owners miss: your policy has to stay true

A privacy policy describes your site on the day you wrote it. Sites don't stand still. Marketing adds a pixel, sales adds a chat widget, someone embeds a booking form, and each one can collect data from visitors that the policy never mentions. CalOPPA asks you to name the categories of third parties you share with, Google's terms ask you to disclose Google Analytics and Meta's ask for notice on every page its pixel runs, so an accurate policy can become an inaccurate one without a single word changing.

We tested how well privacy policy generators keep up. We gave nine of them the same fictional online shop, published every policy, then added the Reddit Pixel to the site. Nine days later, only one Privacy Policy named it: ConsentStack's, 45 minutes after the pixel went live, with no one touching the dashboard. Two Cookie Policies listed the pixel's cookie, but only after the owner logged in or ran a scan by hand. The rest didn't change.

How to get a privacy policy

You have three realistic options. A lawyer is worth it if you handle sensitive data or run a complex business. A generator is fine for most small and mid-sized sites, provided it names the tools your site actually runs and keeps up when they change. A template copied from another site is the riskiest: it describes someone else's tools and practices, not yours.

ConsentStack's Policy Generator is free on every plan, including the free Basic plan. It writes your privacy and cookie policies from the tools it detects on your site plus a short questionnaire, checks every published policy against your site once an hour, and publishes routine changes, like a new tool in a category you already disclose, as a new dated version. Anything that changes what your policy promises waits for your review. It isn't legal advice, so have a lawyer review the result if you need certainty.