Privacy
What should a website privacy policy include?
What a privacy policy needs to say, what it must match, where to link it, and why a generic template copied from another site creates more risk than it removes.
A website privacy policy explains what personal data you collect, why, on what legal basis, who receives it, how long you keep it, how people exercise their rights, and who you are. Under the GDPR it must be clear, easy to find and match what your site actually does, including analytics and third-party tools.
Published · Last updated
What a privacy policy is for
A privacy policy is the notice that tells people what happens to their personal data. Under the GDPR it is a legal obligation for anyone collecting personal data from people in the EU, and similar rules exist in the UK, California and elsewhere. It is also what payment providers, app stores and advertising platforms ask to see before working with you.
What it should include
Under GDPR Article 13, when you collect data directly from people, the notice should cover:
- Who you are: the legal entity and contact details, and the data protection officer if you have one.
- What data you collect: account details, payment data, analytics, cookies, messages.
- Why and on what legal basis: contract, consent, legitimate interest or legal obligation, per purpose.
- Who receives it: hosting, email, analytics, payment and support providers, and any transfers outside the EU with the safeguards used.
- How long you keep each kind of data.
- People's rights: access, correction, deletion, restriction, objection, portability, withdrawing consent and complaining to a supervisory authority.
- Whether any automated decision-making or profiling takes place.
It must match what the site does
The most common problem is not missing sections. It is a policy that describes a different site. If your site loads Google Analytics, a chat widget, a Meta pixel and Stripe, the policy must name those purposes and recipients. If it says you do not use cookies for tracking, there must be no tracking cookies.
Copying another site's privacy policy copies its promises, not your facts. It can make you liable for statements that are untrue for your site.
Where to put it
Link it from the footer of every page, near every form that collects data, and from signup and checkout. Write it in plain language and date it. When your data use changes, update it and tell users when the change matters to them.
AI-built apps and privacy
Apps generated quickly often add services silently: analytics, error tracking, authentication providers, AI APIs that receive user content. List every service your app sends personal data to, including AI providers, and check where they process it before writing the policy.
What a scan can and cannot tell you
WebAuditOS looks for privacy, cookie-policy and contact links, and recognized contact links on privacy-like pages, without reading their destinations. On sampled pages it also checks cookie names against known tracking patterns in a fresh browser before interaction; this does not inspect every storage write or network request.
It cannot read your policy for legal adequacy, know what you do with data on your servers, or give legal advice. A lawyer or data protection specialist should review the text.
If a scan finds tracking before consent and your policy says tracking needs consent, the scan has found a contradiction worth fixing first.
Short answers
Do I need a privacy policy if I only use analytics? Yes, if the analytics process personal data, which most do.
Can I use a privacy policy generator? As a start, if you edit it to match your actual data use.
Where should the privacy policy link be? In the footer of every page and next to data collection forms.
Is a privacy policy the same as a cookie policy? Related but different. Many sites combine them, with the cookie details in a separate section.
In the product
The checks this maps to
Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.
- comp.privacy-policy - Privacy policy linked
- comp.cookie-policy - Cookie policy linked
- comp.dpo-contact - Data protection contact reachable
- comp.contact-info - Contact information reachable
- comp.consent.pre-consent-cookies - Tracking cookies set before consent
Read next
Compliance
Cookie consent, and the GDPR signals a scan can see
What a consent banner has to do to be lawful, which parts of GDPR compliance are visible from outside a website, and which are visible to nobody but you.
Security
How can you tell if a website is safe?
The checks that tell you whether a website is legitimate before you buy or sign up: the address, reputation, company details, payment options and red flags.