Does my business website need a privacy policy?

What California’s law requires

California’s online privacy law, often called CalOPPA, covers the operator of a commercial website that collects personally identifiable information from consumers who live in California and use or visit the site. That operator must conspicuously post a privacy policy on the site.

The law’s definitions list a first and last name, a physical address, an email address and a phone number as personally identifiable information, which covers the usual contact form. A consumer is someone who seeks goods or services “for personal, family, or household purposes”, a description that fits a homeowner asking about a build or a remodel.

The duty sits with you as the owner. The same definitions leave out any third party that operates, hosts or manages a site on the owner’s behalf without owning it, such as a web designer or the platform.

You break the posting rule only if you still haven’t posted a policy 30 days after a notice of noncompliance. The law also counts failing to follow your own posted policy, knowingly and willfully or negligently and materially, as a violation.

Other rules that can apply

Delaware’s law, 6 Del. C. § 1205C, sets the same duty for sites that collect personally identifiable information from Delaware residents, with the same 30 days after notice.

California’s broader privacy law, the CCPA, covers for-profit businesses that meet one of its thresholds, such as gross annual revenue of $26.625 million or more, or buying, selling or sharing the personal information of 100,000 or more California residents or households, according to the California Privacy Protection Agency.

At the federal level, the FTC says that when companies tell consumers they’ll safeguard personal information, it can and does take law enforcement action to make them live up to those promises. So write down only what you actually do.

If you use Google Analytics, its terms of service require you to post a privacy policy that gives notice of the cookies or similar technology used to collect data, and to disclose that you use Google Analytics and how it collects and processes data. Google’s privacy disclosures policy repeats that rule.

What a builder’s privacy page should say

California’s law lists what the policy has to include. In plain terms:

• What personal information your site collects, such as the names, emails and phone numbers from your contact form, and the kinds of companies you may share it with.
• How visitors can review and ask you to change their information, if you offer a way to do that.
• How you’ll tell visitors about important changes to the policy.
• The date the policy takes effect.
• How your site responds to a browser’s “do not track” signal if you collect information about visitors’ activity across other sites over time, and whether other parties can collect that kind of information through your site.

Wix’s guide to creating a privacy policy and Squarespace’s guide to sharing your policies give starting points, and both say they aren’t legal advice. Whatever you start from, describe your own forms and the tools your site actually runs.

Where to add the page on each platform

1. 01

   Wix

   Click Pages & Menu, then + Add Page and + Blank Page, and name it Privacy Policy. Put the policy in a text element, add a text element to the footer, select the words Privacy Policy, click the Link icon, choose Page and pick the new page; Wix’s footer guide covers both the Wix Editor and the Studio Editor.

2. 02

   Squarespace

   Put the policy on its own page and link it from the footer, which Squarespace suggests so the link shows on nearly every page. The page can sit in Not Linked, so it stays out of your main menu.

3. 03

   WordPress

   Go to Settings > Privacy, then click Create New Page, or choose an existing page and click Use This Page; WordPress opens a page with suggested text for you to edit and publish. It also says linking the page from every page of your site is your job, which usually means a footer link, and some themes add one for you.

4. 04

   Duda

   In the side panel, click Settings, then Privacy Settings, and switch on Customize Privacy Page; Duda creates the page if you don’t have one and marks the text you need to change in red. By default it goes live at /privacy on your domain when you republish, and since it doesn’t appear in the Pages panel, Duda’s steps add it to your menu as a new page set to that address; a link in the footer, which is the same on every page, works too.

Link it from the home page

California’s definition of “conspicuously post” includes a text link on the home page that contains the word “privacy”. A footer link labeled Privacy Policy does that on every page at once.

That figure comes from Katsa’s review of 171 builder and remodeler websites, read on October 30, 2026. A link to Google’s reCAPTCHA notice under a form didn’t count, because it leads to Google’s policy, not the builder’s.

How Katsa handles the footer

Every home page Katsa rebuilds has a footer with a current year, your address and a link to your privacy policy. Katsa invents nothing on the page, and you see it on your own site before it goes live.

The home page checklist covers the other four parts of the page.