Privacy Policy for a Website: Start With What Your Site Collects, Then Write What Regulators Ask For

Key takeaways

• Write the policy from your site, not from a template. List every place the site takes in or sends out personal information first. The policy then describes that list.
• A promise you cannot keep is the real risk. The FTC's business guidance says that if you make privacy promises, you need to keep them, and it tells companies to reread their policy to check they are honouring what it says (page read 1 November 2026).
• The OAIC gives a plain checklist. Its guide lists what an Australian policy must describe: what you collect, how you collect and hold it, why, how people access and correct it, how they complain, and whether it goes overseas.
• Rules differ by country. The US, UK, EU and Australia each have a regulator with its own pages. Read the one that covers your visitors, and ask a lawyer when the stakes are high. This guide is not legal advice.

The short answer

A website privacy policy is a public page that tells visitors what personal information your site collects, why, who else sees it, how long you keep it, and how they can ask about it or complain. It sits in the footer of every page and is linked next to any form that takes data.

The hard part is getting it true. A policy that says "we never share your details" while a chat widget and an analytics script receive them is worse than a short policy that names each one. So: find out what happens, write it down, keep it current.

Who is writing: Amariq is a web design studio, not a law firm. Where a regulator page would not load for us, we say so.

What the pages that rank for this search offer

On 1 November 2026 Google, set to the United States and English, showed us vendor pages for this search: guides from Ironclad, Quicksprout, Usercentrics, Mailchimp, Wix and Iubenda, and template pages from LawDepot and Termly. We did not read each in full. The summaries agree on the usual list: who you are, what you collect, why, who receives it, cookies, user rights and a date. Several come from companies that sell a generator or a consent tool.

What they rarely do is show you how to find out what your own site collects, or point you to the regulator who judges the policy. That is the gap here. Every rule below comes from a regulator's own page.

Step 1: Audit what your site collects

Open your site as a visitor and list every place data goes in or out, including tools you forgot you added.

Check your form tool and email tool settings for where submissions are copied, since one submission can sit in three places. On Webflow, our guide to Webflow forms explains where submissions go.

Step 2: What the OAIC says a policy must describe

The Office of the Australian Information Commissioner publishes a "Guide to developing an APP privacy policy". The Australian Privacy Principles are the rules; APP 1 deals with open and transparent management of personal information. We read the guide on 1 November 2026. Here is what it says the policy should describe, in our words.

The guide adds that the list is not exhaustive, and that the policy should be free to read in an appropriate form, with a website as its example. It also says the policy does not replace a collection notice under APP 5, the short notice given when information is collected. In practice that is the line beside a form saying why you ask, with a link to the policy.

The guide does not settle whether the Privacy Act covers a particular small business, so we will not guess. Check the OAIC's small business pages or ask a lawyer. Our guide to website design for Australian small businesses covers other local rules.

Step 3: What the FTC says about promises

The FTC is the US federal consumer protection agency. Its privacy and security pages for businesses, which we read on 1 November 2026, make a few points that matter to a small site owner.

1. Keep your promises. The consumer privacy page tells businesses to reread their privacy policy to make sure they are honouring the promises in it.
2. Promises can be implied. The health privacy page says privacy promises count whether they are stated outright or implied, and that the FTC Act requires you to live up to them.
3. Collect only what you need. The data security page advises collecting only the data you need, keeping it safe and disposing of it securely.
4. Children are a special case. The children's privacy page points to the Children's Online Privacy Protection Act (COPPA), which gives parents control over what websites collect from their children, with FAQs on the FTC site.

For a small site the lesson is simple. Do not copy a policy that promises more than you do. If a template says "we encrypt all data" or "we never use cookies", check it is true first.

The FTC pages do not give a word-for-word list of what a US policy must contain. Some states have their own posting rules. We tried to read California's statute on 1 November 2026 and the page refused our request, so we say nothing about it. Read your state's official page or ask a lawyer.

Step 4: Which regulator page covers your visitors

Open the UK and EU pages yourself if your site serves those visitors. Our UK website redesign guide on VAT and cookies is a starting map, not a replacement for the ICO. With visitors from several countries you need one honest policy covering the strictest list that applies, plus any extra notice a country asks for.

Step 5: Write it in plain words

The OAIC's wording tips travel well. Write for readers, in short plain sentences with no jargon. Be specific, because vague words like "may" invite concern. Lead with sensitive information, anything unexpected and who you share with. Consider a layered approach, a summary of about 500 words or fewer linked to the full policy. Add a version number and a date.

A simple order for the page: who we are and how to contact us; what we collect, grouped by source; why; who else receives it; how long we keep it; how to see, correct or delete it; how to complain; whether data goes overseas; the date of the last update.

Put the link to the page in the footer of every page, and next to every form, as we cover in contact page design.

When a template or generator is enough, and when it is not

A generator is a fair start for a small brochure site with one form, an analytics tool and nothing sensitive. Treat its output as a first draft and walk through the audit table until each line is true.

It is not enough when you take health, legal, financial or children's information (see our therapist and dentist guides), sell to several countries, run advertising tags or session recording, or may be asked to prove what you do. Have a lawyer who knows your country review the final text. A policy also describes security, it does not create it, which is why ongoing website maintenance matters.

When a new tool changes the policy

Every new script can make yesterday's policy false. Update it whenever you add an analytics, chat, booking or email tool, an embed, a bigger form or a new payment provider. When rebuilding, put the policy on the same list as redirects and metadata, as in our website redesign SEO checklist. Platforms also differ in how they handle forms and data; see our platform comparison.

How we help at Amariq

When we plan a site, the data audit comes before the footer link. We list every form, embed and script the design needs, decide with you which ones earn their place, and give you a plain list of what each tool collects so your policy can name them. Then the policy page, the notice beside each form and the footer link are built into the layout on Webflow, Framer, WordPress, Shopify, Wix, Squarespace or a custom build. Projects are priced from the scope, never by the hour. See our web design service or Webflow development.

Frequently asked questions

Does every website need a privacy policy?

If your site collects personal information, such as a name and email through a form, you should have one. Whether the law requires it depends on your country and business, so check the regulator page for your visitors or ask a lawyer.

Can I copy another company's privacy policy?

You should not. A policy has to describe your own site, and the FTC says to keep the promises you make. Copied text often names tools you do not use or promises you cannot keep.

Is a free privacy policy generator good enough?

For a small brochure site it can be a fair first draft. Check every line against your audit and delete what is not true. For sensitive data, several countries, payments or advertising, have a lawyer review the final version.

Where should the link go?

In the footer of every page, and beside every form or booking widget. The OAIC says the policy should be available in an appropriate form such as a website, and a visible footer link makes that practical.

How often should I update it?

Review it regularly and whenever you add a tool or change how you use data. The OAIC suggests a version number and a date on the page.

Does a policy protect me from legal trouble?

Not by itself. A policy is a description, and the FTC's guidance is about doing what you say. This guide is general information and not legal advice, so ask a lawyer about your own case.