The short version
- A privacy policy is the one page that is genuinely mandatory for almost every site, because almost every site collects personal data — an analytics cookie or an IP address in a server log is enough.
- Terms of service are not required by statute anywhere. They are how you get a liability cap, a governing-law clause and a right to terminate an abusive account, none of which exist by default.
- A cookie banner is a consent mechanism, not a notice. If it appears after the trackers have already fired, it is decoration.
- Jurisdiction follows your users, not your servers. Selling to California and Berlin subjects you to California and EU law wherever the company is registered.
The honest framing: one of these pages is compelled by law, one is compelled by the platforms you depend on, and the rest are compelled by the fact that without them you have no written answer when something goes wrong. Treating all five as "the legal pages" is how sites end up with a beautifully drafted terms of service and a privacy policy that does not mention the analytics they run.
What is actually compelling each page
Required by statute
Required by a platform or processor
Protects you if it exists
Only if it applies to you
The privacy policy is the mandatory one
If your site collects, stores or transmits personal data, you are required to say so. The threshold is far lower than people assume: an email address on a contact form is personal data, and so is an IP address in a server log, a Google Analytics identifier, or a cookie that distinguishes one visitor from another. There is effectively no ordinary commercial website that falls outside this.
Three bodies of law do most of the work, and you are usually subject to more than one at once.
| Regime | Reaches you if | The core obligation |
|---|---|---|
| GDPR (EU/UK) | You offer goods or services to people in the EU or UK, or monitor their behaviour | Transparency information: what you collect, your lawful basis, retention periods, transfers abroad, and the rights people can exercise |
| CCPA/CPRA and US state laws | You meet a state's revenue or volume threshold and handle residents' data | Categories collected, purposes, who you share with, opt-out rights, and a policy reviewed at least every twelve months |
| Sector and platform rules | You handle health, financial, biometric or children's data — or ship an app | Additional disclosures and, frequently, affirmative consent before collection rather than after |
Before you write anything, list every third-party script on the site and every place data lands. Analytics, error monitoring, live chat, embedded video, payment processor, email platform, CRM, hosting logs. That inventory is the policy; the drafting is the easy half.
Privacy policy template
The full structure free to read and copy — categories collected, lawful basis, retention, third-party processors, transfers and the rights section that most templates leave out.
Cookie banners are a consent mechanism, not a notice
This is the distinction that determines whether your banner does anything. Under EU and UK rules, non-essential cookies and similar trackers require consent before they are set. A banner that announces "we use cookies" while the analytics and advertising tags have already fired on page load has recorded nothing, because consent obtained after the act is not consent to it.
Two rules that decide whether the banner does anything at all
How easy rejecting is
When the trackers fire
On page load, before any click
Only after a choice is made
"Accept all" beside a buried link
A banner that records nothing
Consent obtained after the act is not consent to it, and the interface is the pattern regulators have been fining.
Fair interface, wrong order
The choice is genuine and it arrives too late. The analytics and advertising tags already fired.
Reject as prominent as accept
Right order, weighted choice
Nothing fires early, and the design pushes one answer. This is where most compliant-looking banners actually sit.
Consent that counts
Prior, freely given, and withdrawable through a durable control somewhere on the site rather than only on first visit.
The US position differs in shape. Most state statutes work on opt-out rather than prior consent, and several require you to honour a browser-level opt-out signal — which is a technical implementation, not a paragraph in a policy. If you sell to both, build for prior consent and let the opt-out follow from it; the reverse does not work.
Terms of service: not required, and the most useful page you have
No statute obliges an ordinary website to publish terms. What terms do is create rights that do not otherwise exist. Without them you have no contractual limit on liability, no stated governing law, no right to suspend an account that is abusing the service, and no licence to display the content your users upload.
What terms are actually buying you
- A limitation of liability, and an exclusion of indirect and consequential loss.
- Governing law and jurisdiction, so a dispute happens somewhere you can afford.
- A right to terminate or suspend accounts, with the grounds stated.
- A licence to host, display and transmit user-submitted content — without it you may be infringing to run your own product.
- Acceptable-use rules you can point at, rather than improvising a justification later.
- A mechanism for changing the terms, and what counts as acceptance of a change.
- Payment, renewal and cancellation terms where you charge — see auto-renewal clauses for the rules that bind you as the seller.
How the terms are presented matters as much as what they say, and that is a large enough subject to have its own guide: terms of service and the click that makes them binding.
The two that depend on what you do
A refund and returns policy
Consumer law in most jurisdictions gives buyers rights whether you publish a policy or not, and in the EU and UK distance-selling rules give a cancellation window that exists regardless of what your page says. What the page does is set out how the process works, and — more immediately — it is a condition of doing business with payment processors and marketplaces, who will ask for it during onboarding and use it when adjudicating a chargeback.
A policy that is more generous than the law is enforceable against you. A policy that is less generous is simply void to that extent, and its presence tends to be read as an attempt to mislead. Write the real one.
A DMCA policy and a designated agent
Only relevant if users can post content. If they can, the US safe harbour that protects you from liability for what they post is conditional: you have to designate an agent with the Copyright Office, publish the agent's details, and operate a notice-and-takedown process. Publishing a DMCA page without registering the agent gets you the paperwork and not the protection.
Where the pages have to live
- Linked from every page, conventionally in the footer. Several statutes require the privacy policy to be reachable from the homepage by a conspicuous link.
- Reachable before collection, not after. A policy linked only from inside the signup flow is late for the data collected on the marketing pages.
- Dated, with a version history. CCPA requires a last-updated date and a review at least annually. It is also the only way to show what a user agreed to in a dispute.
- Not gated. No login, no modal, no PDF download.
A sensible order to do this in
- 1
Inventory the data first
Every third-party script, every form, every place data is stored, and who else can see it. Everything downstream is a description of this list, so getting it wrong makes all four pages wrong together.
- 2
Write the privacy policy against that inventory
Use a template for the structure and the rights language, and replace every generic description with what your stack actually does. Name the processors.
- 3
Fix the cookie implementation, then the banner
Block non-essential tags until consent, then add the interface. Doing it the other way round produces a banner that is legally inert and gives false comfort.
- 4
Add terms, and make acceptance provable
A checkbox at signup, unticked, with the link beside it — and a stored record of which version was accepted, by whom, and when.
- 5
Add the conditional pages
Refunds if you sell, DMCA and a registered agent if users post. Then diarise a review date twelve months out, because the annual review is itself an obligation.
If you are building the whole set, the terms of service, website terms of use, cookie policy, return and refund policy and DMCA policy templates are all published in full here, and are designed to be read alongside each other rather than adopted separately.
General information, not legal advice. This guide explains how these documents and rules generally work. Law varies by jurisdiction and changes, and none of it is applied to your circumstances here. For anything consequential, consult a licensed attorney where you are.
Frequently asked
Do I need a privacy policy if my site has no forms and no accounts?
Almost certainly yes. Web servers log IP addresses, and any analytics, embedded font service, hosted video or CDN will be processing visitor data on your behalf. A brochure site with Google Analytics collects personal data within the meaning of both GDPR and the US state statutes. The only real exception is a purely static page with no analytics, no embeds and no logging — which is rare enough to be worth verifying rather than assuming.
Can I just copy a privacy policy from another site?
Not usefully. A privacy policy makes factual claims about what your site does with data, so copying one imports another company's facts. Regulators and litigants compare the policy against actual behaviour, and a mismatch is easier to act on than an absence. Use a template for structure and legal language, then replace every description with your own processing.
Are terms of service legally binding if nobody reads them?
Reading has never been the test — assent is. Terms are binding where the user was given reasonable notice of them and took an action that manifests agreement, typically ticking a box beside a visible link. Terms available only through a footer link, with no affirmative action, are frequently held unenforceable. The presentation decides this, not the drafting.
Does a US-only business need to care about GDPR?
It depends on who your users are, not where you are. GDPR applies where you offer goods or services to people in the EU or UK, or monitor their behaviour. A US company with no EU marketing, no EU pricing and no EU customers is generally outside it. A US company selling internationally through its website is not, wherever its servers sit.
How often do these pages need updating?
The privacy policy has a hard floor: CCPA requires review at least once every twelve months, and the last-updated date has to be on the page. Beyond that, update whenever the underlying facts change — a new analytics tool, a new payment processor, a new country you sell into. Terms should be re-examined whenever the product changes shape or you enter a new market.