Do I need a privacy policy on my website?
Almost certainly yes, and probably a cookie notice too. What actually triggers the requirement, and why generated policies often make things worse.
If you collect any personal data — including through analytics, contact forms or embedded third-party content — you need a privacy policy in most jurisdictions. If you set non-essential cookies for EU or UK visitors, you also need consent before setting them, not merely a notice.
What counts as collecting data
Far more than people expect. All of these involve processing personal data:
- Analytics of any kind, including self-hosted.
- Contact forms, newsletter signups, account registration.
- Server logs recording IP addresses — which is nearly every server.
- Embedded YouTube videos, social widgets, or fonts loaded from a third-party CDN, all of which disclose the visitor's IP to that third party.
- Advertising and remarketing pixels.
- Live chat widgets.
A site with an embedded video and Google Analytics is processing personal data and sharing it with third parties, regardless of whether it has a form.
What a policy has to actually contain
- Who you are and how to contact you.
- What data you collect, specifically — not "certain information".
- Why you collect it, and your lawful basis if GDPR applies.
- Who you share it with, naming the processors.
- How long you keep it.
- What rights people have and how to exercise them.
- Whether data leaves the jurisdiction, and on what basis.
Cookies are a separate requirement
This is the part most commonly got wrong. Under the EU ePrivacy rules and the UK equivalent, non-essential cookies require consent before being set. That means:
- A banner that says "by continuing you accept cookies" is not consent.
- Loading analytics before the visitor chooses is a violation regardless of what the banner says.
- Rejecting must be as easy as accepting — a prominent Accept and a buried Reject is non-compliant.
- Strictly necessary cookies, such as a session or a security token, do not require consent. Analytics is not strictly necessary.
Why generated policies often make it worse
A generator produces a document describing a generic website. If it lists practices you do not have, it is inaccurate. If it omits the third parties you actually use, it is incomplete. Both are worse than a short honest policy, because a policy that misdescribes your processing is itself a compliance problem — and it misleads the reader, which is the thing the requirement exists to prevent.
If you use one as a starting point, edit it until it describes what you really do. Delete the sections that do not apply. Name your actual processors.
Practical steps
- List every third party that receives visitor data — check your network tab, not your memory.
- Remove the ones you do not need. Each removal reduces obligation and improves speed.
- Write the policy to describe what remains, plainly.
- Link it from every page, conventionally in the footer.
- If you set non-essential cookies, implement consent that actually gates them.
- Review it whenever you add a tool. That is when policies go stale.
This is general information about common requirements, not legal advice. If you handle sensitive data or operate at scale, get advice specific to your jurisdiction and situation.
What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- Whether a privacy policy and terms are present and linked.
- Every third-party script and its origin, so you can see who actually receives visitor data.
- Whether cookies are set before any consent interaction occurs.
- Whether a consent mechanism is present, and whether rejection is as accessible as acceptance.
For agents and scripts, the same measurement is at
/api/v1/privacy?url=yoursite.com —
see the API documentation.
Related questions
I only have a contact form. Do I need one?
Yes. A contact form collects personal data, and your server logs record IP addresses regardless. The policy can be short — it just has to be accurate.
Does GDPR apply to me outside the EU?
It applies if you offer goods or services to people in the EU, or monitor their behaviour. A publicly accessible site with EU visitors and analytics is frequently within scope. Similar rules exist in the UK, California, Brazil and elsewhere.
Can I just use a cookie banner and skip the policy?
No. They address different obligations — the banner handles consent for cookies, the policy explains your processing overall. You generally need both, unless you set no non-essential cookies, in which case you still need the policy.
Read next
How do I make my website look trustworthy?
The signals people and machines actually use — most of which cost nothing and are missing from most small sites.
ReadShould I put my email address on my website?
Yes. The spam argument is weaker than it was, and being uncontactable costs more than the spam does.
ReadIs my website secure? How do I check?
What you can verify yourself in twenty minutes, what needs tooling, and what "secure" does and does not mean.
ReadDoes my about page actually matter?
It is one of the most visited pages on most sites, and one of the few things both people and machines use to judge whether you are real.
Read