US Website Privacy Policy template

Overview

The United States has no single, general federal privacy law comparable to the EU's GDPR. Instead, website privacy obligations arise from a patchwork of sources: the FTC Act Section 5 prohibition on unfair or deceptive practices, which the Federal Trade Commission uses to police privacy policies that misstate or fail to honor their own data practices; the CAN-SPAM Act, which governs commercial email and requires an unsubscribe mechanism and accurate sender information; sector-specific federal statutes such as COPPA (children under 13), HIPAA (health information handled by covered entities), and GLBA (financial institutions), which apply only where the relevant sector or data type is involved; and a rapidly growing set of state comprehensive privacy laws that now form the practical baseline for most commercial websites. California's CCPA, as substantially amended and expanded by the CPRA, is the most detailed and most litigated of these state laws, and is treated as the de facto national baseline by most US businesses given California's market size. It grants consumers rights to know, delete, correct, and opt out of the sale or sharing of personal information, and requires specific disclosures in the privacy policy itself. Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, and a growing list of other states have each enacted their own comprehensive privacy statutes, with materially different thresholds, exemptions, and consumer rights — this is a genuinely fragmented, state-by-state landscape, not a single "US privacy law," and a privacy policy intended for national use should be drafted to satisfy the most protective applicable requirements while noting where a specific state's rights differ. Also relevant: most states have separate data breach notification statutes (all 50 states now have one), which are not part of the privacy policy itself but inform the security and incident response commitments a policy typically references. When to use it: for any commercial website or app that collects personal information from visitors — through forms, cookies, analytics, or account creation — particularly one with any California traffic or customers, given the size and reach of CCPA/CPRA. Key clauses: categories of personal information collected and sources; purposes of processing; categories of third parties personal information is disclosed to, and whether the business "sells" or "shares" data as those terms are defined under CCPA/CPRA (a routine ad-tech integration can trigger this definition even without a literal sale); consumer rights (access, deletion, correction, opt-out of sale/sharing, and non-discrimination for exercising rights), and how to submit a request; cookie and tracking technology disclosures; data retention; children's privacy statement (COPPA, if the site may be used by under-13s); security measures; and contact information for privacy inquiries. Pitfalls to avoid: describing the site as not "selling" data while using third-party advertising or analytics tools that meet CCPA/CPRA's broad definition of sale or sharing; omitting a "Do Not Sell or Share My Personal Information" mechanism where required; and treating this as a single national policy without flagging that specific states (and the EU, if applicable) may grant additional or different rights.