# Website Privacy Policies and Cookie Consent for Small Businesses > Write a privacy policy that matches what your website actually collects, and understand when a cookie consent banner is needed. Canonical: https://vassalmarketing.com/information/website-stewardship/website-privacy-and-cookie-consent/ **Maintained by Vassal Marketing** · Last updated on September 26, 2026 Reviewed at least quarterly and whenever a platform or rule it cites changes. General information, not legal or professional advice. Check rules that affect your business with a qualified professional. Your privacy policy should describe what your website really collects: form entries, analytics, ad pixels, and call tracking. Whether you also need a cookie consent banner depends on where your visitors are and which laws and platform terms apply. Start with an honest list of tools, then have an attorney review the wording. ## Why this matters Most small-business sites collect more than the owner realizes. A contact form collects names and phone numbers. Analytics and ad tools, such as Google Analytics 4 (GA4) or a Meta pixel, set cookies and record visits. Call-tracking services may record calls. Your privacy policy should describe each of these accurately. The FTC expects businesses to keep the promises in their privacy policies. A copied template that promises things your site doesn't do, or leaves out tools it does use, creates that risk. Whether you need a cookie consent banner is a separate question that depends on where your visitors live and which tools you run. ## Responsible practices ### List what the site collects Note every form, analytics tag, ad pixel, chat widget, embedded map or video, booking tool, and call-tracking number. For each, record what it collects, where the data goes, and who can see it. Your provider can check the page code for tags you have forgotten. ### Write the policy to match Say what you collect, why, which outside services receive it, how long you keep it, and how people can contact you about their information. Use plain language. Google Analytics' terms require a privacy policy that discloses its use and its cookies. Update the policy whenever you add or remove a tool. ### Know when a consent banner is expected In the EU and UK, non-essential cookies, such as advertising cookies, generally need consent before they are set. Cookies strictly needed to run the site are exempt. UK rules are being updated, so check the ICO's current guidance. The US has no single federal cookie rule. Keep any banner honest: rejecting should be as easy as accepting, and should actually stop the tags. ### Check US state privacy thresholds California's privacy law (the CCPA, as amended by the CPRA) applies to for-profit businesses that meet any one of three tests. The first is annual gross revenue above an inflation-adjusted threshold, $26,625,000 as of January 2025. The second is buying, selling, or sharing personal information of 100,000 or more California residents or households. The third is earning half or more of revenue from selling or sharing it. Other states set their own tests. Many small businesses fall below them, but ad pixels that share data can change the picture. ### Follow the platforms' own consent rules Google's EU user consent policy applies to sites using its ad and analytics products. It requires consent from visitors in the European Economic Area, the UK, and Switzerland for cookies where legally required and for ad personalization. If you have visitors there, use a consent banner with Google Consent Mode. Other ad platforms have similar terms. ## Worked example: Matching a privacy policy to a real site Hypothetical example: a hair salon's website still uses a template privacy policy written years ago. ### What the site actually runs A contact form, an online booking widget, GA4, a Meta pixel left over from an old ad campaign, and an embedded map. ### What the old policy said It mentioned the contact form only. It did not name the analytics, the pixel, or the booking provider. ### What changed The owner removed the unused pixel, listed each remaining tool with what it collects and who receives the data, and had the plain-language rewrite reviewed by an attorney. ### The consent question Nearly all visitors are local. The provider set up tags so a consent banner can be switched on if the salon later advertises to visitors in regions that require one. The policy is only as accurate as your list of tools. Update both whenever you add a tag or widget. ## Privacy checklist ### What you can check 1. List every form, tag, pixel, and tracking tool on your site. 2. Compare that list with your current privacy policy. 3. Check your analytics for roughly where your visitors come from. 4. Confirm with a qualified attorney for your situation before finalizing the policy or consent approach. ### What to ask your provider to handle 1. Scan the site for cookies, tags, and pixels, and document what each one collects and where it sends data. 2. Set up a consent banner, where needed, that blocks non-essential tags until the visitor agrees and records the choice. 3. Configure Google Consent Mode for GA4 and Google Ads so tags respect the visitor's choice. ## Avoid these failures - Copying another site's privacy policy that describes different tools. - Adding a pixel for an ad campaign without updating the policy. - Using a banner whose "Reject" button doesn't actually stop tracking. - Assuming no law applies without checking where your visitors and customers are. Good website care lowers risk, but no provider can guarantee uninterrupted service. ## Questions business owners ask ### Does every small-business website need a privacy policy? If the site collects personal information, including through forms or analytics, you should have one. Google Analytics' terms require a policy that discloses its use, and some state laws require one too. ### Do I need a cookie banner? It depends on where your visitors are and which tools you use. Visitors in the EU, UK, or Switzerland generally trigger consent for non-essential cookies, and Google's policy requires it for its products there. Many US-only local businesses fall below state thresholds. ### Can I use a free privacy policy generator? It can be a starting point. Check every statement against what your site actually does, and remove anything that isn't true. ### Does Google Consent Mode replace a banner? No. Consent Mode adjusts how Google tags behave based on the visitor's choice. The banner is what collects that choice. ## Primary guidance - [FTC: Privacy and security guidance for business](https://www.ftc.gov/business-guidance/privacy-security) - [California Privacy Protection Agency: Updated monetary thresholds in the CCPA](https://cppa.ca.gov/regulations/cpi_adjustment.html) - [Google: EU user consent policy](https://www.google.com/about/company/user-consent-policy/) - [UK ICO: Guide to PECR — cookies and similar technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/) ## Connected guidance - [GA4 setup and data quality](https://vassalmarketing.com/information/measurement-analytics/ga4-setup-and-data-quality.md): Set up Google Analytics 4, including Consent Mode, under business control. - [Forms, calls, and booking paths](https://vassalmarketing.com/information/website-stewardship/forms-calls-and-booking-paths.md): Test that customer requests reach the right people and can be answered. - [Review privacy and customer data](https://vassalmarketing.com/information/reviews-reputation/review-privacy-and-customer-data.md): Handle customer details carefully when requesting and responding to reviews.