Browse Definitions :

privacy policy

What is a privacy policy?

A privacy policy is a legal document that explains how an organization handles any customer, client or employee information gathered in its operations. It will include how data is collected, stored, used, shared and protected and the user's rights in connection to the data. It is required by law in the European Union, the State of California and other jurisdictions.

A privacy policy might be required for privacy compliance.

A privacy policy should specify any personally identifiable information (PII) that is gathered, such as name, address and credit card number, as well as other information like order history, browsing habits, uploads and downloads. The policy should also explain if data can be left on a user's computer, such as cookies. The policy should disclose if data can be shared with or sold to third parties and if so, what the purpose is.

For simple privacy policies, the first statement found in an online privacy policy is one to the effect that, by visiting the webpage (which you are doing if you're reading the policy), you agree to the details of the site's privacy policy. Some jurisdictions now require that the consumer give active consent, meaning that this type of clause is no longer binding.

Many sites now use a clickwrap (click through) agreement to prove user agreement to a privacy policy. These are much more defensible in court than policies that rely on passive agreement, such as by simply using a site. Clickwrap agreements often pop up at the bottom of a site with an accept or reject prompt. Adding a checkbox affirming that the consumer read and understood the terms of the privacy policy can further protect the organization. The date, time and identifying information of the acceptance should be tracked.

Sources of customer personal data diagram
A privacy policy includes how personal data is collected, stored, used, shared and protected.

Privacy policy and cookie policy

A privacy policy covers all aspects of how a service collects and uses consumer data. A cookie policy only applies to website cookies, which can be used for consumer identification. It is now common for a service's privacy policy to also contain a cookie policy. These can be separate documents in some cases though.

What should a privacy policy include?

Privacy policies need to be written in simple-to-understand language. They should not use complicated legal terms and jargon. Most privacy policies are written and enforced in English, even if it is not the official language of the country. It is good practice though to provide high-quality translations of a privacy policy in every language in which a service is used.

A privacy policy should include the following information:

  • Types of data collected -- name, date of birth, location, etc.
  • How data is collected -- user entry, cookies, etc.
  • How the data will be used -- marketing, usability, service functionality, etc.
  • If the data will be shared or sold -- third-parties, partners, etc.
  • How the data will be stored and protected -- service locality, encryption, etc.
  • How to opt out and request deletion, including how to file requests and privacy questions.
  • Date the policy comes into effect.
  • Contact information for privacy-related requests.
  • Other information that might be required according to the consumer's jurisdiction.

Privacy policy jurisdictions and enforcement

The United States currently has no federal laws that directly require or enforce privacy policies. The FTC (Federal Trade Commission) is promoting industry self-regulation and enforcement of current laws. Current U.S. laws mainly protect medical personal health information with HIPAA and children's privacy with COPPA (Children's Online Privacy Protection Act).

Several U.S. states have enacted laws protecting consumers' digital privacy. California has passed several such laws, such as the California Consumer Privacy Act (CCPA).

The European Union has passed many consumer data privacy laws. The most notable being the General Data Protection Regulation (GDPR). This protects all EU citizens, even if the business is not located in the EU. It strictly defines how companies collect and store data and includes fines for non-compliance.

Other countries including Australia, Canada and India have laws that might require a privacy policy.

Even though they are not required for every country, it is now best practice for every service to have a public privacy policy to cover consumers in jurisdictions that require them. Privacy policies might include language to cover specific requirements of some of these laws and have sections dedicated to each of them.

Check out the top 10 customer data privacy best practices and how data anonymization best practices protect sensitive data. See how to use a data privacy framework to keep your information secure and overcome GDPR compliance challenges. Explore privacy controls to meet CCPA compliance requirements and how to comply with the CCPA.

This was last updated in November 2023

Continue Reading About privacy policy

  • SD-WAN security

    SD-WAN security refers to the practices, protocols and technologies protecting data and resources transmitted across ...

  • net neutrality

    Net neutrality is the concept of an open, equal internet for everyone, regardless of content consumed or the device, application ...

  • network scanning

    Network scanning is a procedure for identifying active devices on a network by employing a feature or features in the network ...

  • cloud penetration testing

    Cloud penetration testing is a tactic an organization uses to assess its cloud security effectiveness by attempting to evade its ...

  • cloud workload protection platform (CWPP)

    A cloud workload protection platform (CWPP) is a security tool designed to protect workloads that run on premises, in the cloud ...

  • out-of-band authentication

    Out-of-band authentication is a type of two-factor authentication (2FA) that requires a secondary verification method through a ...

  • strategic management

    Strategic management is the ongoing planning, monitoring, analysis and assessment of all necessities an organization needs to ...

  • IT budget

    IT budget is the amount of money spent on an organization's information technology systems and services. It includes compensation...

  • project scope

    Project scope is the part of project planning that involves determining and documenting a list of specific project goals, ...

  • director of employee engagement

    Director of employee engagement is one of the job titles for a human resources (HR) manager who is responsible for an ...

  • digital HR

    Digital HR is the digital transformation of HR services and processes through the use of social, mobile, analytics and cloud (...

  • employee onboarding and offboarding

    Employee onboarding involves all the steps needed to get a new employee successfully deployed and productive, while offboarding ...

Customer Experience
  • chatbot

    A chatbot is a software or computer program that simulates human conversation or "chatter" through text or voice interactions.

  • martech (marketing technology)

    Martech (marketing technology) refers to the integration of software tools, platforms, and applications designed to streamline ...

  • transactional marketing

    Transactional marketing is a business strategy that focuses on single, point-of-sale transactions.