Privacy Policy and Cookie Banner Basics
If your website collects any personal information, whether through a contact form, newsletter sign-up, analytics, or online orders, you are likely to have obligations about how you tell people about it and how you handle it. This article gives a general overview. It is not legal advice, and requirements vary by country, region, and industry, so check what applies to you or consult a qualified professional.
What is personal data?
Personal data is information that can identify a person, directly or indirectly. It includes names, email addresses, phone numbers, addresses, IP addresses in some jurisdictions, and online identifiers collected through cookies. If your site stores or processes any of this, privacy rules may apply.
Why have a privacy policy?
Many laws require you to be transparent about your data practices. Regulations such as the EU and UK GDPR, California's privacy laws, and others set rules on notice, purpose, consent, and individual rights. Third-party services, such as advertising platforms and analytics tools, often require you to have a policy too.
A privacy policy also builds trust, showing visitors that you handle their information responsibly. See trust signals for online stores.
What a privacy policy typically covers
- Who you are, and how to contact you
- What data you collect, such as form details, order information, and analytics
- Why you collect it, and your legal basis where required
- How you use and share it, including service providers like email platforms, payment processors, and hosting companies
- How long you keep it
- Where it is stored or transferred
- Cookies and similar technologies
- People's rights, such as access, correction, and deletion, and how to exercise them
- How to complain or contact a regulator
- When the policy was last updated
Write it in clear language, and make sure it matches what you actually do. Copying someone else's policy without checking is risky, since their practices differ from yours.
Cookies and consent
Cookies are small files stored on a visitor's device. Some are essential, like those that keep items in a shopping basket. Others support analytics, preferences, or advertising. In many regions, non-essential cookies require informed consent before they are set.
A good cookie banner
- Explains in plain language what is used
- Lets visitors accept, reject, or customize with equal prominence
- Does not set non-essential cookies before consent where required
- Links to your cookie and privacy policies
- Lets visitors change their mind later
- Works with a keyboard and screen reader and does not block the entire page. See accessibility basics
Consent tools exist to help manage this. Choose one that is compatible with your analytics and advertising setup, and check its effect on speed. See Core Web Vitals.
Privacy-friendly alternatives
Some analytics tools do not use cookies or collect personal data, which may reduce your need for consent banners. Check the rules and the tool's documentation. See website analytics basics.
Forms and marketing consent
Be clear about what you will do with details people enter in forms. Do not pre-tick consent boxes for marketing where the law requires active consent, and keep records of consent. See contact form design.
Other legal pages
Depending on your business, you may also need terms and conditions, a returns policy, an accessibility statement, or industry disclosures. See shipping and returns pages.
Protect the data you collect
Policies are promises. Back them up with sensible security. See keeping your website secure and website backups.
Link to it everywhere
Place a link to your privacy policy in the footer, near forms, and at checkout.
Review regularly
Update the policy when you add new tools or change practices. Add this to your annual maintenance checklist.
The bottom line
Be transparent about the data you collect, get consent where the law requires it, and keep your policy accurate. When in doubt, ask a professional.