Privacy Policy Generator

A privacy policy generator gives you a clear first draft of the page every business website needs: what personal information you collect, why you collect it, who you share it with and what rights your visitors have. Our free Privacy Policy Generator walks you through five short steps, asks about the forms, payments, newsletters, analytics, advertising pixels and cookies you actually use, and builds a plain-English policy that updates live as you answer. Pick the regions you serve and it adds sections that cover points commonly required under the EU and UK GDPR, the California CCPA, other US state laws, Canada's PIPEDA, Australia's Privacy Act and Brazil's LGPD. Export it as clean HTML, Markdown or plain text, or print it. Treat the result as a starting-point template, not legal advice: review every line and have a lawyer check it if your business is regulated.

How to use the Privacy policy generator

1. 1 Enter your business detailsAdd your business or legal name, website, contact email, address and the country you are based in, then set the effective date. Anything you leave blank shows as a [bracketed] placeholder so you can spot it.
2. 2 Choose the regions you serveTick the places where your visitors or customers live, such as the EU, the UK, California or Canada. Each one adds a short section on the rights people there commonly have and who they can complain to.
3. 3 Describe the data you collectTick the things your site really does: contact forms, accounts, orders, online payments, newsletters, analytics, advertising pixels, cookies, location and any sensitive or children's data. The policy adds or removes sections to match.
4. 4 Select your third-party servicesPick the tools that touch visitor data, such as Google Analytics, Stripe, PayPal, Mailchimp, the Meta Pixel or reCAPTCHA, and add any others in your own words. They are listed by name and purpose in the policy.
5. 5 Set retention and rights, then exportChoose a general or specific retention statement, the email for privacy requests and whether you share data for advertising. Then copy or download the policy as HTML, Markdown or text, or print it to PDF.

Why your website needs a privacy policy

Almost every business website collects some personal information, even when it does not feel that way. A contact form collects names and email addresses. Your web server records IP addresses in its logs. An analytics script measures which pages people visit, and an advertising pixel can tell an ad platform that a visitor came from one of its ads. Privacy laws in many parts of the world require you to explain this openly, in language an ordinary person can understand, before or at the point you collect the information.

A privacy policy is also a practical requirement outside the law. Google Ads, Meta, app stores, payment providers and many email platforms ask you to publish one before they let you use their tools, and customers increasingly look for it before they fill in a form. A clear policy signals that you have thought about their data, which builds trust with the people you most want to hear from.

The catch is that a policy has to describe what your business really does. Copying another company's page is risky, because it will describe their tools, their data and their legal position rather than yours, and it may be protected by copyright. A generator gives you a structured draft built from your own answers, which you can then refine.

What a good privacy policy covers

Different laws use different words, but they ask similar questions. A solid small business policy usually answers each of the following, and the generator builds a section for each one that applies to you:

• Who you are: your business name, address and contact details, and for EU and UK visitors, the fact that you are the controller of their data.
• What you collect: the information people give you, the information collected automatically when they browse, and anything you receive from other companies.
• Why you use it: responding to enquiries, delivering orders, sending newsletters, improving the site, advertising, security and legal compliance.
• Legal bases: for the EEA and UK, which lawful basis you rely on, such as contract, legitimate interests, consent or legal obligation.
• Cookies: what cookies and similar technologies do on your site and how visitors can control them.
• Sharing: the types of companies that receive data, the named services you use, and whether you sell or share data for advertising.
• International transfers: whether data leaves the country and what safeguards you rely on.
• Retention and security: how long you keep information and how you protect it, without promising perfect security.
• Rights: how people can access, correct or delete their data, how to contact you, and where to complain.
• Children, changes and contact details: who the site is not meant for, how you will announce updates, and how to reach you.

How the region-specific sections work

Privacy rights depend on where a person lives, not only on where your business is based. A bakery in Ohio that ships to customers in Germany may need to think about the GDPR, and a software company in London with users in California may need to think about the CCPA. That is why the generator asks where your visitors and customers are, then adds a short section for each region you select.

The EU and UK section mentions the right to object, rules on automated decision-making and the right to complain to a supervisory authority such as the UK Information Commissioner's Office. The California section lists the categories of personal information you collect, explains the rights to know, delete, correct and opt out of selling or sharing, and adds wording about the "Do Not Sell or Share My Personal Information" link and Global Privacy Control signals if you use advertising pixels. Other US states, Canada, Australia and Brazil each get a brief summary of the main rights and the regulator people can contact.

Not every law applies to every business. The CCPA, for example, only covers for-profit businesses that cross certain thresholds, and Australia's Privacy Act currently exempts many small businesses with an annual turnover of AUD 3 million or less, with exceptions such as health service providers. Including a region's section when the law does not strictly apply to you is usually harmless and can still be good practice, but it is no substitute for checking your own obligations.

Cookies, analytics and advertising pixels

Cookies and tracking scripts are where many small business policies go wrong. Strictly necessary cookies, such as those that keep a shopping cart working, are treated differently from analytics and advertising cookies. In the EEA and the UK, non-essential cookies generally need the visitor's consent before they are set, which means a consent tool that actually blocks those scripts until someone agrees, and that makes rejecting as easy as accepting.

Advertising pixels deserve special care. When the Meta Pixel, a Google Ads tag or a similar tool sends information about your visitors to an ad platform, several US state laws may treat that as "sharing" for cross-context behavioral advertising, or as targeted advertising, even though no money changes hands. If you use pixels and serve California or other US states, the generator nudges you to say so and to offer an opt-out.

This tool writes the policy only. It does not create a cookie banner or manage consent. Many website builders and consent platforms provide banners, some with free plans, and your policy should describe the setup you actually use.

Making the template fit your business

A generated policy is a starting point. Before you publish it, read it from top to bottom as if you were a customer, and check each statement against reality. If the policy says you keep enquiries for two years, make sure you really delete them after two years. If it lists Mailchimp but you moved to another email platform, update it. Remove anything that does not apply and add anything specific to your business that the generator could not know about, such as a loyalty program, CCTV at your premises or recorded phone calls.

Specific retention periods are better than vague ones where you can commit to them, because regulators and customers both prefer clear answers. Check your analytics tool's own data retention setting, your accounting rules for how long invoices must be kept, and your email platform's settings, then enter the periods you actually follow.

Some businesses should always get a qualified lawyer to review their policy. That includes healthcare providers, financial services, anyone collecting data from children, businesses handling large volumes of sensitive data and companies that sell personal information. Health data in the United States may also fall under HIPAA, which needs its own notice of privacy practices that this generator does not produce.

Publishing and maintaining your policy

Put the policy on its own page, such as /privacy-policy, and link to it from your website footer so it is reachable from every page. Link to it again next to forms that collect personal information, at checkout and in your newsletter sign-up. If you use the HTML export, paste the article snippet into your website builder or CMS; the Markdown export suits static site generators and documentation tools, and plain text works for platforms that strip formatting.

Review the policy whenever you add a new tool, start selling online, launch a newsletter, begin advertising or expand into new countries, and at least once a year even if nothing obvious has changed. Update the effective date each time. Your answers are saved as a draft in your browser on this device, so you can come back, change a few options and export a fresh version in minutes.

Examples you can copy

<footer>
  <nav aria-label="Legal">
    <a href="/privacy-policy">Privacy Policy</a>
    <a href="/terms">Terms of Service</a>
  </nav>
</footer>

<p class="form-note">
  We use your details only to reply to your message.
  See our <a href="/privacy-policy">Privacy Policy</a>
  for how we handle personal information.
</p>

## How long we keep information

- Enquiries and correspondence: 2 years after our last contact.
- Customer, order and account records: as long as required by tax and accounting law.
- Newsletter subscriptions: until you unsubscribe.
- Analytics data: 14 months.
- Server and security logs: 90 days.

Common mistakes to avoid

Frequently asked questions