The short answer
A small business needs a website privacy policy as soon as its site collects personal information, because California’s CalOPPA applies to any site that collects it from California residents. The policy lists what you collect, who you share it with, how you handle Do Not Track and when it took effect. AI drafts it well from an exact inventory of your forms and tools; without one, it makes things up.
We make Extra, an AI agent platform, so this article is written by an interested party. Facts about other tools and about the law come from the sources listed at the bottom, as of the date shown.
Does a small business website need a privacy policy?
Yes, in practice, as soon as the site collects personal information: a contact form, online booking, a newsletter signup, customer accounts, analytics or ad pixels. A privacy policy is the page that tells visitors what you collect, why, who you share it with and what choices they have. In the US there is no single federal privacy law for small businesses, but California’s Online Privacy Protection Act (CalOPPA) reaches almost every site, because it applies to any website that collects personally identifiable information from California residents, wherever the business is based.
It is not the same as your terms of service (the rules for using the site) or a cookie banner (which records choices about tracking). A clean small business site has a privacy policy, terms if you sell online, and a way to honor tracking choices where state law requires it.
AI is useful here because most of the work is an inventory: listing what the site really collects. It writes quickly and clearly; it cannot know on its own which tools run on your site.
What must a privacy policy include?
Under CalOPPA (Business and Professions Code section 22575), the policy must identify the categories of personal information you collect and the third parties you may share it with, describe how users can review and request changes if you offer that, explain how you announce material changes, and state an effective date. Since 2014 it must also disclose how the site responds to browsers’ “Do Not Track” signals and whether other parties can collect information about users’ activity across sites.
| Section | Example for a physical therapy clinic |
|---|---|
| Who we are | Clinic name, address, contact email |
| What we collect | Name, phone, email, appointment requests, site usage data |
| Why | Answer inquiries, book visits, send reminders, improve the site |
| Who we share it with | Booking software, email provider, web host, analytics provider |
| Tracking | Which cookies or pixels run, and how the site treats Do Not Track |
| Your choices | How to update, delete or opt out, and who to contact |
| Changes | How you notify changes, effective date |
Health information collected by a covered provider falls under HIPAA, which has its own notice of privacy practices. A website policy does not replace it; it sits next to it.
How do you write a privacy policy with AI?
The method takes five steps, and the decisive one is the inventory, which AI cannot do for you without seeing your site and accounts.
- Take inventory: every form, every connected tool (booking widget, email marketing, analytics, ad pixels, chat), and the data each one receives.
- Give it to the AI with your business name, host and how long you keep each kind of data.
- Ask for two layers: a three-line notice next to each form, and the full policy section by section.
- Review line by line: does every tool named actually exist on your site? Is every practice described one you follow?
- Date it and update it every time you add a tool.
Sample instruction: “Write the website privacy policy for [business], using only this inventory. One section for each item CalOPPA requires, including Do Not Track. Short sentences, plain English. Do not add any tool, purpose or practice that is not in the inventory. Flag anything missing in brackets.”
Example: a catering company whose site has a quote form, a newsletter and Google Analytics, and also a Meta pixel its web designer added last year. The owner forgot the pixel; the inventory finds it. The policy must say a third party collects browsing data across sites, which a generic template would have missed.
When do bigger privacy laws like the CCPA apply?
The California Consumer Privacy Act applies only to businesses that cross its thresholds, the best known being annual gross revenue above $26,625,000 since January 1, 2025 (up from $25 million). Most small businesses fall under it only if they buy, sell or share a lot of consumer data.
- Revenue threshold: $26,625,000, adjusted for inflation by the California Privacy Protection Agency.
- Fines: up to $2,663 per violation, or $7,988 per intentional violation or one involving minors under 16.
- Other states: Virginia, Colorado, Texas and others have their own comprehensive privacy laws with their own thresholds; check the states where your customers live.
- CalOPPA enforcement: the California Attorney General enforces it, with penalties of up to $2,500 per violation under the Unfair Competition Law.
Whatever the law, the policy must be true. Describing practices you do not follow is a bigger risk than a short, honest policy.
Template, generator or lawyer: which one?
For a brochure site with one form, a well-adapted template or an AI draft from your inventory is enough. Once you handle sensitive data (health, children) or run targeted ads, a review by a lawyer is worth the cost.
| Option | Upside | Risk |
|---|---|---|
| Copy another site’s policy | Free | Describes someone else’s tools, copyright issues |
| Online policy generator | Fast, full structure | Boxes ticked at random, generic text |
| AI from your inventory | Specific to your site, readable | Only as accurate as the inventory |
| Privacy lawyer | Handles hard cases | Cost |
What does AI get wrong on a privacy policy?
AI gets wrong what it cannot see: the tools actually connected, where data goes, how long you keep it. Left alone, it produces a policy that looks complete and is wrong in substance.
- It invents “reasonable” retention periods that match nothing you do.
- It names tools you do not use, or misses the one your designer added.
- It mixes European GDPR language with US law unless you name the country.
- It cannot honor opt-outs for you: a policy describes choices, your site has to apply them.
How does Extra help with a privacy policy?
Extra (hello-extra.com), the AI agent platform for small businesses, gives legal documents to Clara. Clara reviews your privacy policy or terms, annotates missing or vague passages, compares two versions and exports the corrected document (see Clara). Ryan, who builds and publishes Extra sites, can add the privacy and terms pages to the site he creates.
Clara does not replace a lawyer for sensitive data. Extra costs $99 per month for all eight agents (pricing), and ours is published on our privacy page. To go further: writing a contract with AI, what happens to your data with an AI agent and our guide to AI agents for small businesses.
Common questions
Does a brochure site with no form need a privacy policy?
If the site truly collects no personal information and runs no tracking, CalOPPA may not be triggered. In practice almost every site runs analytics or ad pixels, or logs visitor data through its host: take the inventory before deciding you are exempt.
Where should the privacy policy go?
In the footer of every page, and linked next to each form with a three-line summary. CalOPPA requires the policy to be conspicuously posted, which in practice means a clearly labeled link on the home page.
How often should you update it?
Every time you add a tool, a purpose or a new kind of recipient. Change the effective date and keep the old version, so you can show what was posted on a given date.
Is a privacy policy enough for cookies and pixels?
Not everywhere. The policy describes tracking; some state laws also require honoring opt-out signals or offering a way to opt out of targeted advertising. Check the laws of the states where your customers live once you run ad pixels.
Sources
- California Business and Professions Code section 22575, via California Public Law, accessed 11/07/2026
- IAPP, “What do the new disclosure requirements under CalOPPA mean for your business?”, accessed 11/07/2026
- California Privacy Protection Agency, “Updated Monetary Thresholds in CCPA,” accessed 11/07/2026
