Does a small business website need a privacy policy?

Updated September 26, 2026

Does your small business website need a privacy policy if it only has a few pages and a contact form? Start by finding out what information the site and its connected services collect. Then check with your state and a qualified lawyer about the notices and choices your particular business needs.

Begin with what your website actually collects

A website can handle customer information even when it does not sell products. A request for a plumbing estimate might include a name, phone number, home address, and photos of a bathroom. A booking form might send appointment details to another company's scheduling service.

Open each page as a visitor and list the places where information changes hands:

• Contact and estimate forms.
• Appointment booking tools.
• Newsletter signups.
• Payment links and checkout pages.
• Chat boxes and customer accounts.
• Analytics, advertising tools, and embedded content.

Do not assume a feature collects nothing because you do not see the information yourself. Ask your website provider what the host, form service, and other tools record. A plain website without forms can still have hosting logs or connected services to examine.

Keep the inventory specific. "Estimate form sends name and phone number to the office inbox" is more useful than "we use customer data."

Get advice about the rules that apply to you

This is general planning guidance, not a determination of your legal obligations. Your business location is part of the question, but it is not the only fact to discuss. Tell your adviser where your customers are, what information you collect, and which outside services receive it.

The California Attorney General's guide to reading privacy policies is one official starting point for understanding online privacy disclosures. Use your own state's official resources as well. Do not assume another business's policy covers your situation because it operates in the same trade.

Bring your website inventory to a lawyer and ask practical questions:

• Which privacy disclosures apply to our website and business?
• Where should those disclosures appear?
• Do any tools require additional notices or visitor choices?
• How should we handle customer requests about their information?

If you handle health information, children's information, financing applications, or other sensitive material, mention that specifically. A general website checklist cannot settle those questions.

Prepare accurate facts for the policy

You can do useful preparation before anyone drafts legal wording. Write down your actual practices in plain English so the person reviewing the policy does not have to guess.

Describe what customers submit and why. For example, a landscaper may need a street address to check whether a property is within the service area. Explain where requests go, which staff can access them, and which outside companies help process them.

Also record how long you currently keep old inquiries and why. If you have no retention process, say so to your adviser instead of copying a deletion promise you cannot carry out.

Prepare a working contact address for privacy questions. Identify who will monitor it and who can find records in the systems you use. A published contact route should connect to a real process, not an inbox nobody opens.

Avoid absolute statements such as "we never share information" until you understand how your vendors handle it. Sending a form submission to an email or scheduling provider is something to discuss during that review.

Collect less information where you can

Review each form field against the next step in the job. An initial request for a fence estimate may need a town, contact details, and a description of the project. It probably does not need an alarm code or payment card number.

Use the contact form guide to separate information needed for an inquiry from details better collected later through an appropriate process. Avoid inviting customers to upload sensitive documents into an ordinary estimate form.

The FTC's business data security guidance recommends collecting only what you need, protecting it, and disposing of it securely. Apply that principle to duplicate inboxes, unused form tools, and old spreadsheets as well as the live website.

A privacy policy is a description of practices, not a substitute for them. Decide who needs access to requests, remove access when someone leaves, and ask your provider how information is protected. Those operational questions belong alongside the wording review.

Put the policy where customers can find it

Once the wording and placement have been reviewed, publish the policy as a readable page. Use a clear link label such as "Privacy policy." Include it in your website footer so visitors can find it from different pages.

Ask your adviser whether forms or booking steps also need notices or links near the point of collection. Do not treat a footer link as an answer to every privacy requirement.

Check the page on a phone. The text should be readable, links should open the intended pages, and a visitor should not need an account to read it. Confirm the named business and contact address are yours.

Do not add a cookie banner simply because another site has one. Ask which controls your actual tools require, then have your provider verify that the controls do what their wording says. A button label alone does not establish how tracking works.

Review privacy when the website changes

Add privacy review to your website maintenance routine. A new chat service, advertising tool, appointment system, or file upload field may change the facts the policy needs to describe.

Before a feature goes live, ask what it collects, where the information goes, and who can access it. Send the answers to the person responsible for your policy. Keep a note of the reviewed changes so the next website provider can understand the setup.

If you remove a tool, check for leftover forms, scripts, and links. Review old promises too. A policy pointing to a retired email address is not useful to a customer trying to ask a question.

Frequently asked questions

Do I need a policy if I only have a phone number on the site?

Check the whole website setup, including hosting and any connected tools. Ask a lawyer about your situation rather than assuming the absence of a form settles the question.

Can I copy a competitor's privacy policy?

Use your own practices as the starting point. A competitor may use different services, collect different information, or make promises your business cannot meet.

Is a free policy generator enough?

A generator may help you prepare a draft, but its output depends on the information you provide. Have the result checked against your actual website and applicable requirements.

Does having a privacy policy make my website secure?

No, publishing words does not change access controls or how information is stored. Review the technical setup and your staff's handling of customer information separately.

The short version

Inventory your forms, connected tools, and information handling before drafting a privacy policy. Check your state's guidance and ask a qualified lawyer what your business needs. Keep the published wording and your actual practices aligned as the site changes. For a website with ongoing content changes included, Front Step Sites starts at $99 a year with the domain included and no setup fee.