Does your website need a privacy policy and cookie banner?

Almost every business website needs a privacy policy, and whether you need a cookie banner depends on where your visitors are and what tracking you use. In the US, California's CalOPPA requires a posted privacy policy for commercial sites that collect personal information from California residents (a contact form is enough), and Google Analytics' terms require you to disclose your use of Analytics. Cookie banners that ask for consent first are mainly an EU and UK requirement. US state laws mostly use an opt-out model, which can mean a "Your Privacy Choices" link and honoring the Global Privacy Control signal.

This is general information, not legal advice. Privacy laws change often and depend on your business, your customers and where they live. Talk to a qualified attorney before you decide what your site needs.

We build and maintain websites, not legal documents, so think of this as a map of the questions to ask. Everything below links to the official source.

The short answer by situation

When a privacy policy is required in the US

CalOPPA

The California Online Privacy Protection Act is the main reason almost every US business site needs a privacy policy. The California Attorney General's guide, Making Your Privacy Practices Public, says CalOPPA applies to operators of commercial websites and online services that collect personally identifiable information from California residents. You do not have to be based in California.

Under CalOPPA, your policy must be conspicuously posted and must:

• Describe the categories of personal information you collect.
• Name the categories of third parties you share it with.
• Explain how users can review and request changes, if you offer that.
• Explain how you will notify users of material changes.
• Give the policy's effective date.
• Disclose how you respond to "Do Not Track" browser signals, and whether other parties may collect information about users' activity over time and across sites.

State consumer privacy laws

California's CCPA (as amended by the CPRA) and a growing list of similar laws in other states give consumers rights to know, delete and opt out. These laws have thresholds, so many small businesses are not covered. Examples from official sources:

• California (CCPA): The California Privacy Protection Agency's FAQ says a for-profit business doing business in California is covered if it meets one of these: annual gross revenue of $26.625 million or more (the adjusted figure since January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling or sharing personal information.
• Colorado: The Colorado Attorney General's Colorado Privacy Act page says the law applies to businesses that process personal data of more than 100,000 Colorado consumers in a year, or that earn revenue or discounts from selling the personal data of 25,000 or more consumers.
• Texas: The Texas State Law Library's summary says the Texas Data Privacy and Security Act generally exempts small businesses as defined by the SBA, but even exempt small businesses must get consent before selling sensitive personal data.

Other states have their own thresholds and dates. Check each state's attorney general site, or ask your attorney which ones reach your customers.

Google's terms

Even if no law applied, Google's Analytics terms of service require you to post a privacy policy that gives notice of your use of cookies, discloses that you use Google Analytics and explains how it collects and processes data. Google suggests linking to its page on how Google uses data from partner sites. The terms also forbid sending Google personally identifiable information. Ad platforms have their own policies, so read the terms for any ad tools you use.

What a privacy policy should include

A clear policy for a small business usually covers:

• Who you are and how to contact you about privacy.
• What you collect: form entries, order details, emails, cookies, IP addresses and device data.
• How you collect it: forms, checkout, analytics, chat widgets, ad pixels.
• Why you use it: responding to inquiries, fulfilling orders, improving the site, advertising.
• Who you share it with: hosting, email, CRM, payment, analytics and ad providers.
• Cookies and tracking: what you use and how to opt out.
• Do Not Track and GPC: how your site responds.
• Rights and requests: how people can access, correct or delete their data, if you offer that or the law requires it.
• Data security and retention: in plain terms.
• Children: a statement if your site is not aimed at children.
• Effective date and how you announce changes.

The biggest mistake we see is a policy that does not match reality. If the policy says "we do not use cookies" and the site runs Google Analytics and a Meta pixel, that is worse than a short, honest policy. Audit your third-party scripts first.

Cookie banners: EU and UK rules

In the EU, the ePrivacy Directive's Article 5(3) says storing or reading information on a visitor's device requires their consent, after clear and comprehensive information, unless it is strictly necessary for a service the user asked for or needed to carry a communication. GDPR then sets the standard for what valid consent means.

The UK has similar rules under PECR. The UK Information Commissioner's Office cookie guidance says:

• Consent needs a clear positive action. Continuing to browse does not count, and pre-ticked boxes are not allowed.
• Visitors must be able to decline and still use the site, and withdraw consent later.
• Shopping cart, security and load balancing cookies can be strictly necessary. Analytics and advertising cookies are not.

The UK's Data (Use and Access) Act 2025 changed PECR, and the ICO's updated guidance now covers new exceptions for statistical purposes and site appearance. Read the ICO's current guidance, or ask a UK adviser, before relying on them.

US opt-out tools and Global Privacy Control

Most US state laws do not require consent before cookies. Instead, covered businesses must let people opt out of the "sale" or "sharing" of personal data and targeted advertising. That can include data passed to ad networks through pixels.

Global Privacy Control is a browser signal that says "do not sell or share my data." The CPPA's FAQ says businesses covered by the CCPA must honor opt-out preference signals like GPC and generally must offer a "Your Privacy Choices" link (or similar) in the header or footer. Colorado's attorney general says controllers had to honor recognized universal opt-out mechanisms starting July 1, 2024, and describes GPC as the state's first one. Several other states have similar requirements, and in September 2025 regulators in California, Colorado and Connecticut announced a joint sweep focused on whether businesses honor GPC.

Google Consent Mode v2

If you use Google Ads or Analytics with visitors in the European Economic Area, Google's EU user consent policy requires you to get consent where legally required, keep records and tell users how to withdraw it. It covers end users in the EEA, the UK and Switzerland.

Google's consent settings page says Analytics looks for the ad_user_data and ad_personalization signals for EEA users, and that personalized advertising and remarketing require affirmative consent signals. Consent Mode passes your visitors' banner choices to Google tags. Our GA4 setup guide explains basic versus advanced Consent Mode.

Your options for a banner

• Platform built-ins. Shopify, Squarespace and Wix include cookie banner settings, and they can be enough for a simple site.
• Consent management platforms (CMPs). Tools like Cookiebot, OneTrust, Termly, CookieYes and iubenda scan your site for cookies, show region-based banners, log consent and send Consent Mode signals. Many have free or low-cost small business plans.
• WordPress plugins. Several cookie consent plugins work with Google's Site Kit plugin, according to its plugin page.

Whatever you choose, test it. Decline all cookies, then check your browser's developer tools to confirm the trackers actually stay off.

Generator or lawyer?

A privacy policy generator asks questions and builds a policy from your answers. For a simple site with a contact form and analytics, a reputable generator you keep updated is a reasonable starting point. Bring in an attorney if you:

• Sell online or store customer accounts.
• Handle health, financial, children's or other sensitive data.
• Run remarketing ads or share data with partners.
• Have customers in the EU or UK, or might meet a state law threshold.

Either way, the policy only works if it matches what your site actually does.

A practical checklist

• List every tool that collects data: forms, analytics, pixels, chat, embedded videos, maps.
• Post a privacy policy linked in your footer, with an effective date.
• Disclose Google Analytics and any ad tools, per their terms.
• Decide whether any state privacy law thresholds apply to you (ask an attorney).
• If covered, add a "Your Privacy Choices" link and honor GPC.
• If you have EU or UK visitors, use a consent banner that blocks non-essential cookies until they agree.
• Set up Consent Mode if you use Google Ads or Analytics with EEA visitors.
• Remove trackers you no longer use.
• Review the policy whenever you add a new tool, and at least once a year.

Privacy is part of running a trustworthy site, alongside the basics in our website security checklist and our guide to cybersecurity for small business websites. If you collect leads, see how to connect website forms to email or a CRM safely.

Need help finding every tracker on your site or setting up a banner that actually works? Talk to us. We will handle the technical side and work alongside your attorney on the wording.