A website privacy notice should describe what the organization actually does with personal information, not what a template assumes it does. Start with a data map, identify which laws and contracts apply, draft the notice from those facts, and test every link and request method. This checklist is operational guidance rather than legal advice; regulated, multi-jurisdiction, child-directed, health, financial, employment, or high-risk processing needs qualified legal review.
Inventory every collection point
List forms, account registration, checkout, analytics, advertising tags, embedded media, chat, support tools, newsletter sign-up, appointment booking, surveys, cookies, device identifiers, logs, uploaded files, and offline information later connected to the site. For each entry point, record the data fields, source, purpose, system of record, access roles, vendor, transfer destination, retention rule, and deletion path.
The Federal Trade Commission's guide for protecting personal information recommends tracing how personal information enters, moves through, and leaves a business and identifying who can access it. A banner scan or tag list is helpful evidence, but it will miss manual exports, customer-service copies, and information collected outside the browser unless people who operate those systems participate.
Describe purposes and recipients precisely
Group data into categories that a reader can understand, then explain the real purpose for each category. Distinguish service delivery, account security, payment processing, measurement, personalization, advertising, legal obligations, and user-requested communications. Avoid unlimited phrases such as 'for any business purpose.' If a purpose is optional, explain the available choice.
Identify the categories of service providers, contractors, affiliates, advertising partners, or other recipients and the reason information reaches them. Check contracts and product settings instead of relying on a vendor's marketing page. Do not say information is never shared if a processor, embedded service, or cross-context advertising arrangement receives it. Use the legal definitions that apply to the organization; ordinary language and a statute may use 'sell' or 'share' differently.
Put required notices where collection happens
A general policy page and a just-in-time notice serve different roles. For businesses subject to the California Consumer Privacy Act, the California Department of Justice's CCPA overview says notice at collection identifies categories of personal information and their purposes and must be available at or before collection. The California Privacy Protection Agency's general-notices guide also lists categories, purposes, sale or sharing status, intended retention, applicable opt-out link, and a link to the privacy policy. Confirm whether the law applies before copying California-specific language.
Place the relevant notice near each form, account flow, checkout, cookie choice, or other collection point. Test it on a small screen, with keyboard navigation, and with assistive technology. A footer link may support access to the full policy, but it does not necessarily replace a notice required at the moment information is collected.
Explain rights, choices, and verification
State which people can make requests, the rights available to them, the methods for submitting a request, and how the organization verifies identity without collecting excessive new information. Explain cookie or advertising choices, account controls, communication preferences, and any opt-out preference signal the business is required to honor. Keep statutory rights separate from optional customer-service promises.
The California sources describe rights to know, delete, correct, opt out of sale or sharing, limit certain sensitive-information uses, and avoid discrimination, along with instructions for exercising those rights. Other jurisdictions differ. The notice should name the scope rather than suggesting that one process or deadline applies worldwide. Test the published email address, form, phone route, and authorized-agent process where relevant.
Align retention, security, and internal practice
Give a meaningful explanation of retention: a category-specific period or the criteria used to determine it when the applicable rule permits that approach. Compare the statement with database settings, backups, logs, support systems, vendor deletion, legal holds, and offline records. Saying information is deleted after account closure is inaccurate if required records or backups remain under a documented exception.
Describe security at a truthful level without publishing a defensive blueprint. Internally, limit access, revoke departing users, review vendor safeguards, and keep an incident process. The FTC guide recommends understanding access and information flow, restricting sensitive data to people with a need to know, and setting written security expectations for service providers. A notice cannot compensate for a missing control.
Publish, test, and maintain
Use a clear title containing the word 'privacy,' a visible last-updated date, contact information, and language suitable for the audience. Keep an approved version history and evidence of the data map used for each revision. Decide what change requires a new notice, consent, or direct communication instead of silently rewriting the page.
Test the live policy from the home page and every collection flow. Submit a sample rights request through each stated method and confirm routing, acknowledgment, verification, fulfillment, and recordkeeping. Review after a new vendor, form, data use, advertising tool, jurisdiction, acquisition, or incident and on a regular cadence. The notice is ready only when the public words, product behavior, vendor contracts, and internal response process agree.
Sources
- Protecting Personal Information: A Guide for Business — Federal Trade Commission
- California Consumer Privacy Act — California Department of Justice, Aug. 28, 2026
- What General Notices Are Required By The CCPA? — California Privacy Protection Agency
- NIST Privacy Framework — National Institute of Standards and Technology