Does a small business website need a privacy policy

For your trade 6 min read

What a privacy policy on a small trades site is actually for, when you genuinely need one, and how to write the page without paying anybody.

Somebody has told you your website needs a privacy policy. Maybe a customer mentioned it, maybe an email arrived from whoever hosts your contact form, maybe you noticed the link in the footer of another company's site and wondered what happens because yours has no such thing. It is not a question you can settle at the trade counter, and it sits on the list for months because nobody knows where to start.

Start with what your site actually collects

Before the law, before the wording, work out what the site takes from a stranger. For most small trades sites the honest list is short.

A contact form takes a name, a phone number, an email address, and a few sentences about a leak or a lock or a broken furnace. That is personal information. So is a booking widget, a quote calculator that emails you the answers, and a callback request.

Then there is the part you did not choose. If the site has Google Analytics, a Facebook pixel, an embedded map, an embedded video, or a chat bubble in the corner, other companies are collecting things about your visitors through your site. That happens whether or not you ever look at the numbers.

The two reasons the page exists

The first reason is a stranger with a reasonable question. They are about to type their address and their phone number into a box belonging to a business they have never met. The policy answers what happens next: you get an email, you call them back, nobody sells the details.

The second reason is that the tools you already use require it. Google's terms for Analytics and Ads require a privacy notice that discloses what you are doing with them. Meta requires the same for the pixel. Most form and booking providers say it in their terms too. This is a far more practical reason than any statute, and it applies to you the moment somebody dropped a tracking code onto your homepage.

The law, said honestly

There is no single American law that says every website must have a privacy policy. There are several state laws that reach beyond their own borders, and one of California's applies to commercial sites that collect personal information from people in California, with no small business cut-off in it. Colorado's own privacy law has thresholds a one-truck business will not come near.

That is the whole honest answer. Somebody who tells you a plumber in Castle Rock is one form submission away from a fine is selling something. Somebody who tells you it is definitely fine to have no policy at all is guessing on your behalf.

What goes on the page, in plain words

Six things, and they can be one short paragraph each.

What you collect, listed by the thing that collects it: the contact form, the booking form, the phone number if you record calls. Why you collect it, which is to answer the inquiry and do the work. Who else sees it, meaning your email provider, your form provider, and any of the tracking tools that are actually on the site. How long you keep it. How somebody asks you to delete theirs, with a real email address that reaches you. And who to contact, with a business name and a town.

Write it as though you were answering the question out loud. "When you fill out the form on this site, it sends me your name, your phone number and what you wrote, by email. I use it to get back to you about the work. I do not sell it or pass it to anybody else."

The mistakes that make a policy worse than nothing

Copying another company's policy is the common one, and the wreckage is easy to spot: another business's name still in the text, a clause about their mobile app, a mailing address in a different state, a promise about data your site has never handled. A reader who spots that stops believing the rest of the site.

Claiming you collect nothing while Analytics runs on every page is the second one. That is a policy that says something untrue about your business in writing, which is exactly the thing a policy exists to avoid.

Describing tools you dropped two years ago is the third. If the pixel came off when the site was rebuilt, the page should stop mentioning it.

Where it goes and what to call it

One link in the footer, on every page, reading Privacy Policy. That is the place people look for it, and putting it in the main menu just crowds out the services.

Add one line under the send button on the form itself, in normal type: what you do with the details, and a link. That sentence is doing more work for you than the whole policy page, because it is the only version anybody reads at the moment it matters.

What this page cannot do for you

A privacy policy describes what you do. It does not make a careless habit lawful, and it does not protect details sitting in an inbox that four people share a password to.

It is also not legal advice, and neither is this article. If your site takes card payments, handles patient information, deals with anybody under thirteen, or you work under a contract that says something specific about data, pay somebody qualified for an hour. That hour costs money, and in those situations it is the right call.

For everybody else, this is not a thing you need to hire out. A generator will produce a workable page in ten minutes. An hour with a blank document will produce a better one, because you are the only person who actually knows what your site collects.

Before you publish it

• List every form on the site and what each one asks for
• Find out whether Analytics, a pixel, a chat widget or an embedded video is running
• Write the page in your own words, or edit a generated one until it is true
• Delete every clause about something you do not do
• Put your own business name, town and a working email in it
• Link it from the footer of every page
• Put one plain sentence under the form's send button
• Read it again whenever the site changes, and put the date on it

Questions people ask

Do I need a privacy policy if my site has no contact form

If the site is only pages and a phone number, with no analytics and nothing embedded, there is genuinely very little for a policy to describe. Most sites are not that, so check what is running before you decide you are the exception.

Can I copy a privacy policy from another website

No, and not mainly for copyright reasons. It describes their business, their tools and their inbox, and every sentence of it that is wrong about you is a sentence you have published about yourself.

Is a free privacy policy generator good enough

For an ordinary trades site, usually yes, as long as you read the output and cut the parts that do not apply. The generator does not know what your site loads, and you do.

Does a privacy policy help my Google ranking

Nobody outside Google can honestly tell you that. Have the page because your form collects real details from real people, which is reason enough.

What about cookies, do they go in the same page

The tracking side is a related but separate question, including whether your site needs a banner at all, and it is worth reading whether you need a cookie banner before adding anything to your homepage.

Somebody emailed asking me to delete their details, what do I do

Find every copy: your inbox, your phone, the form provider's dashboard, and any spreadsheet you keep. Delete them, reply saying you have, and keep a short note of the date.