★ 5.0 on Google · No long contracts · You own every asset
Rathly

What legal pages should a business website have (privacy policy, terms, and disclaimers)?

Short answer

Most business websites need a privacy policy, and many also need terms of use, an accessibility statement and industry notices. California law requires a posted privacy policy on commercial sites that collect personal details from Californians. Health providers covered by HIPAA must post their privacy notice. Have a lawyer review your pages.

In this answer
  1. 01The pages most sites need
  2. 02Why a privacy policy is a must
  3. 03Industry rules
  4. 04What a good privacy policy says

The pages most sites need

PageWhen you need it
Privacy policyAny site with a contact form, analytics or ads
Terms of useSites with accounts, bookings, payments or content rules
Accessibility statementRecommended for every business site
Cookie noticeSites using tracking or ad cookies, depending on your visitors
Text messaging termsSites that collect consent for marketing texts
Industry noticesHealthcare, legal, finance and other regulated fields

Why a privacy policy is a must

Contact forms collect names, phone numbers and emails. California's online privacy law, known as CalOPPA, requires commercial websites that collect personal information from California residents to post a privacy policy conspicuously. Your visitors can be in California even if your business is not.

Larger businesses may also fall under California's consumer privacy law, the CCPA. It applies to companies above set thresholds, like gross annual revenue over $25 million. Covered businesses that sell or share data need a "Do Not Sell or Share My Personal Information" link.

Industry rules

Health providers covered by HIPAA that run a website about their services must post their notice of privacy practices on it. Law firms often need advertising disclaimers under state bar rules. Businesses that text customers need clear terms for their messaging program.

What a good privacy policy says

  • What you collect and why
  • Which tools collect data, like analytics and ad pixels
  • Who you share data with
  • How people can ask for access or deletion
  • How to contact you about privacy

Good example. A clinic's privacy policy names its analytics tool, its CRM and its text messaging provider, and explains how patients can contact the office.

Bad example. A clinic copies a policy from another site that mentions an app it does not have and never mentions its forms.

This is general information, not legal advice. Our web design team sets up these pages and links them sitewide, with your lawyer reviewing the text.

Keep reading

Related answers

All Web design questions →

Your agency isn't delivering? Talk to us.

  • ✓ You talk to the people who do the work
  • ✓ We handle 95% of requests the same or next day
  • ✓ You own every account, site and listing
Talk to usSTEP 1 OF 2
What isn't working?
No contract. Cloudflare Turnstile blocks spam.
Call usTalk to us →