Website stewardship guide 15
Your privacy policy should describe what your website really collects: form entries, analytics, ad pixels, and call tracking. Whether you also need a cookie consent banner depends on where your visitors are and which laws and platform terms apply. Start with an honest list of tools, then have an attorney review the wording.
← All website stewardship guidanceList what the site collects
Match the policy
Check where visitors are
Set up consent
Review after changes
Why this matters
Most small-business sites collect more than the owner realizes. A contact form collects names and phone numbers. Analytics and ad tools, such as Google Analytics 4 (GA4) or a Meta pixel, set cookies and record visits. Call-tracking services may record calls. Your privacy policy should describe each of these accurately.
The FTC expects businesses to keep the promises in their privacy policies. A copied template that promises things your site doesn't do, or leaves out tools it does use, creates that risk. Whether you need a cookie consent banner is a separate question that depends on where your visitors live and which tools you run.
Responsible practices
Note every form, analytics tag, ad pixel, chat widget, embedded map or video, booking tool, and call-tracking number. For each, record what it collects, where the data goes, and who can see it. Your provider can check the page code for tags you have forgotten.
Say what you collect, why, which outside services receive it, how long you keep it, and how people can contact you about their information. Use plain language. Google Analytics' terms require a privacy policy that discloses its use and its cookies. Update the policy whenever you add or remove a tool.
In the EU and UK, non-essential cookies, such as advertising cookies, generally need consent before they are set. Cookies strictly needed to run the site are exempt. UK rules are being updated, so check the ICO's current guidance. The US has no single federal cookie rule. Keep any banner honest: rejecting should be as easy as accepting, and should actually stop the tags.
California's privacy law (the CCPA, as amended by the CPRA) applies to for-profit businesses that meet any one of three tests. The first is annual gross revenue above an inflation-adjusted threshold, $26,625,000 as of January 2025. The second is buying, selling, or sharing personal information of 100,000 or more California residents or households. The third is earning half or more of revenue from selling or sharing it. Other states set their own tests. Many small businesses fall below them, but ad pixels that share data can change the picture.
Google's EU user consent policy applies to sites using its ad and analytics products. It requires consent from visitors in the European Economic Area, the UK, and Switzerland for cookies where legally required and for ad personalization. If you have visitors there, use a consent banner with Google Consent Mode. Other ad platforms have similar terms.
Worked example
Hypothetical example: a hair salon's website still uses a template privacy policy written years ago.
The policy is only as accurate as your list of tools. Update both whenever you add a tag or widget.
Privacy
List every form, tag, pixel, and tracking tool on your site.
Compare that list with your current privacy policy.
Check your analytics for roughly where your visitors come from.
Confirm with a qualified attorney for your situation before finalizing the policy or consent approach.
Scan the site for cookies, tags, and pixels, and document what each one collects and where it sends data.
Set up a consent banner, where needed, that blocks non-essential tags until the visitor agrees and records the choice.
Configure Google Consent Mode for GA4 and Google Ads so tags respect the visitor's choice.
Avoid these failures
Good website care lowers risk, but no provider can guarantee uninterrupted service.
Questions business owners ask
If the site collects personal information, including through forms or analytics, you should have one. Google Analytics' terms require a policy that discloses its use, and some state laws require one too.
It depends on where your visitors are and which tools you use. Visitors in the EU, UK, or Switzerland generally trigger consent for non-essential cookies, and Google's policy requires it for its products there. Many US-only local businesses fall below state thresholds.
It can be a starting point. Check every statement against what your site actually does, and remove anything that isn't true.
No. Consent Mode adjusts how Google tags behave based on the visitor's choice. The banner is what collects that choice.
Primary guidance
Plan the next step