How to Write a Website Privacy Policy Visitors Can Read

Most privacy policies are written to be skipped. They are long, full of legal phrases, and often copied from a template that describes some other company's website. Visitors scroll past them, and the organization behind them is not always sure what they promise.

A good privacy policy does the opposite. It tells people, in plain language, what information you collect, why, who else receives it and what choices they have. That builds trust, and it keeps your own team clear about how you handle personal information.

This guide focuses on clarity and honesty. It is not legal advice. Privacy laws differ by location and by what kind of information you handle, so if you collect sensitive information, serve children, or have visitors in places with strict privacy laws, have an attorney review your policy.

Step 1: Inventory what your website actually collects

Before writing a word, list every way your site gathers information. Common sources include:

• Contact forms: names, email addresses, phone numbers and messages.
• Newsletter sign-ups and the email service that stores your list.
• Donations, payments and orders, usually handled by a payment processor.
• Event or class registrations.
• User accounts and member areas.
• Analytics tools that measure visits.
• Cookies and similar technologies.
• Embedded content such as videos, maps and social media posts, which can let other companies collect information.
• Chat widgets, comment systems and scheduling tools.
• Server logs your hosting provider keeps, which often include IP addresses.

For each, note what is collected, why, where it is stored, which outside companies are involved and how long you keep it.

Step 2: Organize the policy around readers' questions

Use plain headings that match what people want to know:

1. Who we are and how to contact us about privacy.
2. What we collect, grouped by activity: when you contact us, donate, register or browse.
3. How we use it, with specific purposes, such as replying to messages or sending receipts.
4. Who we share it with, such as payment processors, email services and hosting providers, and whether you sell personal information.
5. Cookies and analytics, including how to manage choices.
6. How long we keep it.
7. Your choices and rights, such as unsubscribing, accessing, correcting or deleting information.
8. Children's information, if relevant.
9. How we protect it, in general terms.
10. Changes to this policy, with a "last updated" date.

Step 3: Write it in plain language

• Use "we" and "you." It reads like a conversation.
• Keep sentences short and avoid unexplained legal terms.
• Be specific. "We use your email address to send the receipts and updates you request" is clearer than "We may use information for business purposes."
• Give examples where they help understanding.
• Consider a short summary at the top, with the full details below.

Step 4: Make sure it is true

The biggest risk with templates is promising something that is not accurate. If your policy says you never share information with third parties, but your site uses analytics, embedded videos and a third-party email service, the policy is wrong. Match every statement to your inventory.

Be especially careful with absolute words like "never," "always" and "completely." Promise only what you actually do, and then do it.

Step 5: Make it easy to find

Link your privacy policy in the footer of every page and near forms that collect information. Give people a clear way to contact you with questions, such as a contact form, and respond promptly.

Step 6: Keep it current

Your policy needs updating whenever you add a new form, tool, analytics service or embedded widget. Add a review to your website maintenance plan at least once a year, and check it during a website launch. Cookies and consent are closely related; our guide to cookie banners and consent explains that side.

If you would like help thinking through what your site collects, contact us.

Frequently asked questions

Do I need a privacy policy if I only have a contact form?

A contact form collects names and email addresses, and many laws and service providers expect a privacy policy when you collect personal information. A short, accurate policy is a good practice even for a simple site.

Can I use a privacy policy generator?

Generators can help you structure a policy, but you must customize the result to match what your site actually collects and does. Have an attorney review it if you handle sensitive information or have specific legal obligations.

How often should I update my privacy policy?

Review it at least once a year and whenever you add a new tool, form or service that collects information. Update the "last updated" date when you make changes.