Why Your Website Most Likely Needs a Privacy Policy and What Must Be In It

The California Online Privacy Protection Act requires a website to “conspicuously post” a privacy policy if it “collects and maintains personally identifiable information from a consumer residing in California.”

“Personally identifiable information” is defined very broadly to include a first and last name, a physical address, an e-mail address, a telephone number, or any other information that permits the contact of an individual.  So, even if you are not selling a product, your website will need a privacy policy if visitors can submit their e-mail addresses to receive news and updates from you.

If a privacy policy is required, it must contain five items:

1. Information Collected - The categories of personal information the website collects.
2. The categories of third-parties with whom the company shares the information.
3. How the consumer can review and request changes to their information collected by the company.
4. How the company notifies consumers of material changes to its privacy policy.
5. The effective date of the privacy policy.

If you are required to have a privacy policy, it must be “conspicuously posted.”  The policy is conspicuously posted if it:

1. Appears on the homepage of your website – usually not an aesthetically pleasant option.
2. The website can have an icon on the home page that contains the word “privacy” – not a bad option.
3. The most popular option is to have a link at the bottom of the homepage that contains the words “Privacy Policy.”

Under the California Unfair Competition Law, website operators who do not comply with the California Online Privacy Protection Act could be sued by the California Attorney General, District Attorneys, County Counsel, or City Attorneys for "unfair competition."

Privacy policies vary depending on how the website collects and uses consumer information, but a good example is the privacy policy for Modify Watches, which can be viewed here.

The key is to not only make sure the privacy policy complies with the law, but to also have the policy be easy to understand so visitors do not get frustrated with legalese when trying to determine how their personal information is being collected and used by your website.

Disclaimer: This post discusses general legal issues, but it does not constitute legal advice in any respect.  No reader should act or refrain from acting on the basis of any information presented herein without seeking the advice of counsel in the relevant jurisdiction.  Doug Bend expressly disclaims all liability in respect of any actions taken or not taken based on any contents of this post.

Doug Bend is the principal of The Law Office of Doug Bend, a law firm focused on start-up and small businesses.  He is also the General Counsel for Modify Industries, Inc. and tIFc LLC and a Legal Mentor in The Hub Ventures Program, which provides funding and resources to a community of social entrepreneurs, and for the Young Entrepreneur Council, a non-profit dedicated to helping young entrepreneurs start successful businesses.  He prides himself in providing individuals and businesses with quality legal representation in forming, maintaining and growing business entities of many types, including corporations, limited liability companies and limited partnerships and in providing general legal advice and counsel.