If your website has a contact form, it collects names, email addresses and phone numbers, and if any of the people filling it in live in California, a state law already requires you to post a privacy policy. There is no revenue threshold and no minimum number of visitors. What the law asks a small business to write is short, and most of it is a description of things you already know.
The law that applies to almost everyone: CalOPPA
The California Online Privacy Protection Act, in California’s Business and Professions Code sections 22575 to 22579, applies to the operator of a commercial website that collects “personally identifiable information” from California consumers who use or visit it. The definition of that information starts with first and last name, a physical address, an email address and a telephone number. A contact form asking for a name and an email is enough.
The law does not care where your business is. A roofer in Ohio whose site is read by someone in San Diego is in the same position as a roofer in Fresno, and since you cannot stop Californians filling in a form, a business website with a form needs a policy. The statute defines a consumer as someone buying for personal, family or household purposes, so a business that sells only to other businesses is arguably outside it, but most local businesses serve households, and this is not a gap worth relying on.
CalOPPA is enforced through California’s unfair competition law, under which civil penalties run up to $2,500 per violation. The statute gives an operator 30 days to post a policy after being told it is out of compliance, which is a reason not to panic and not a reason to wait.
What CalOPPA says the policy must contain
Section 22575 lists the contents. In plain terms:
-
Categories
Categories of personal information you collect, and the categories of third parties you share it with: “name, email and phone number”, “our email provider and our website host”.
-
Corrections
Corrections, meaning how a person can review and ask you to change what you hold about them, if you offer a way to do that. For a small business, “email us” is a process.
-
Changes
Changes to the policy, and how you will tell people about material ones.
-
Effective
Effective date: the date the current version took effect.
-
Do Not Track
Do Not Track: how your site responds to a browser’s “do not track” signal or a similar choice mechanism.
-
Others
Others who may collect information about a visitor’s activity over time and across different sites when they use yours: an advertising pixel, for example.
The policy also has to be “conspicuously posted”. The statute’s simplest version is a text link that includes the word “privacy” on the homepage. In practice, a link in the footer of every page meets it.
Do Not Track: what to write
The Do Not Track requirement is a disclosure, not an obligation to honor the signal. California’s Attorney General described the 2013 amendment that added it as a transparency measure. Most small business sites do not change their behavior when a browser sends the signal, and the honest sentence is the compliant one:
- Right “Our website does not change how it works in response to Do Not Track signals.”
- Not “We respect your Do Not Track settings”, on a site where nothing reads them.
Global Privacy Control, a newer browser signal, is different: some state laws make covered businesses treat it as an opt-out. Whether any of them covers you is the next section.
Why the CCPA probably does not apply to you
The California Consumer Privacy Act is the law with access and deletion rights, opt-out links and regulators of its own. It applies to a for-profit business that meets at least one of three tests. According to the California Privacy Protection Agency, the revenue test has been $26,625,000 in annual gross revenue since January 1, 2025, and it is adjusted for inflation every odd-numbered year. The other two are buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or earning half or more of annual revenue from selling or sharing personal information.
A local plumber, café or dental office meets none of them. Be careful with the second test if your site carries advertising pixels that count as sharing, but a site with a contact form and basic analytics is a long way from 100,000 Californians.
The other state laws, in general terms
About twenty states now have comprehensive privacy laws of the CCPA kind, and they differ in detail. The pattern for small businesses is consistent: most apply only to businesses that process the data of 100,000 or more residents of that state in a year, and a few set the bar lower, at 35,000 residents or fewer. Connecticut is the most recent to move, lowering its threshold from 100,000 to 35,000 on July 1, 2026. Texas and Nebraska have no headcount threshold but exempt small businesses as the federal Small Business Administration defines them, with one exception in Texas: even a small business needs consent before selling sensitive data.
If your business handles health information, sells data, or has customers across many states online, those details matter and are worth a conversation with an attorney. A local business with a contact form is very unlikely to be covered by any of them today.
The FTC: say what you do
There is no general federal law requiring a website to have a privacy policy. What there is, is Section 5 of the FTC Act, which prohibits deceptive practices, and the FTC treats a privacy policy that misdescribes what a business does as one of them. Its business guidance on privacy puts it directly: if you make privacy promises, expressly or by implication, “the FTC Act requires you to live up to those claims.” The FTC has brought privacy cases against companies large and small.
A copied template is the usual way small businesses get this wrong. A policy taken from another site often promises things yours does not do (“we never share your information with third parties”, on a site that sends every form to an email provider and every visit to Google Analytics) or describes features it does not have. Each of those sentences is a statement about your business, and under Section 5 a false one is the problem, not the absence of a policy.
If your site is directed at children under 13, or knowingly collects information from them, a separate federal law, COPPA, applies with its own rules. Most local business sites are not.
What a contact form and analytics actually collect
Before writing anything, list what your site really does. For a typical small business site, that is:
-
Forms
Forms collect whatever fields you ask for, usually a name, an email address, a phone number and a message, and send them somewhere: your inbox, a form service, a booking tool or a CRM. Each of those is a third party that receives the data.
-
Hosting
Hosting logs record the visitor’s IP address, browser and the pages requested. Almost every web server keeps them for a period, for security and troubleshooting.
-
Analytics
Analytics tools record which pages were viewed, roughly where from and on what device. Google says Google Analytics 4 does not log or store IP addresses, but it uses cookies, and its terms of service require you to post a privacy policy that discloses your use of Google Analytics and how it collects and processes data.
-
Embeds
Embeds such as a Google map, a YouTube video, a booking widget or a spam check load content from another company’s servers, which receive the visitor’s IP address and may set cookies of their own.
-
Pixels
Pixels from Meta, Google Ads or similar advertising tools follow visitors across sites. These are the “other parties” CalOPPA asks you to disclose.
If your site has no analytics, no embeds and no pixels, say so. That is a shorter policy, not a weaker one.
What to put in your privacy policy
- Your business name and how to contact you about privacy: an email address is enough.
- The effective date, at the top.
- The categories of personal information you collect, from forms, logs and any tools.
- Why you collect it: to answer inquiries, quote, book, invoice.
- The categories of third parties who receive it: email provider, host, form or booking service, analytics, payment processor.
- Whether any other party may collect information about visitors across sites, and which kind (analytics, advertising).
- How your site responds to Do Not Track signals.
- How long you keep inquiries and records, in plain terms.
- How someone can review, correct or ask you to delete their information.
- That you do not sell personal information, if that is true.
- How you will tell people about material changes, such as a notice on the page and a new effective date.
- A link to the policy in the footer of every page, with the word “privacy” in it.
Read it once a year and whenever you add a tool to the site. A new booking widget or ad pixel changes what the policy has to say, and nobody else will notice that it is out of date. If your website also needs an accessibility review, the same yearly check is a good time for it; there is more on that in ADA website lawsuits and small businesses.
This is general information about the law as of October 2026, not legal advice. If your business handles health, financial or children’s data, or operates at a scale where the state laws may apply, ask an attorney licensed in your state.
Not sure what your current site collects, or whether its privacy page matches it? Send us your address and we will reply in writing with the three things we would change.
