Privacy policies and cookie banners: what a small business website actually needs

Every website template comes with a privacy policy somebody else wrote and a cookie banner that slides up over the page. Then the emails start: a "compliance" service warning that your site breaks privacy law, offering a subscription to fix it.

Most of that is aimed at businesses far bigger than yours. But not all of it, and one Washington law in particular catches small businesses that have no idea it exists. This article is what the rules actually ask of a local business website, quoted from the laws themselves, and what they do not.

I am a web developer, not a lawyer, and nothing here is legal advice. If you have had a letter rather than a sales email, show it to a lawyer.

• You need a privacy policy. A contact form is enough to need one, and so is Google Analytics.
• It has to be true. A copied policy that describes things your site does not do, or leaves out things it does, is the real risk. A missing banner is not.
• You almost certainly do not need a cookie banner. No law covered here asks a local US business for one. The banner is a European rule, and Google's own consent requirement covers visitors in Europe, the UK and Switzerland.
• The big privacy laws have thresholds you will not reach. California's starts at more than $26 million in revenue; Oregon's at personal data from 100,000 people a year.
• The exception is health information in Washington. The My Health My Data Act covers small businesses too. If your website asks about anyone's health — an injury, an allergy, a symptom — read that section below.

The law usually quoted is California's, known as CalOPPA. It says that "an operator of a commercial Web site or online service that collects personally identifiable information" from people in California must "conspicuously post its privacy policy on its Web site."

"Personally identifiable information" is defined in the next section of the law, and it starts with "a first and last name", "an e-mail address" and "a telephone number". In other words, a contact form. You do not have to be in California for it to apply; somebody in California has to fill in your form. For a business near Portland, that is a matter of time.

It is not a trap. The law says you are in breach "only if the operator fails to post its policy within 30 days after being notified of noncompliance." But it is the reason the floor is "have one", and it is not the only one.

The services on your site require one too. Google Analytics' terms of service say: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies" used to collect data, and "You must disclose the use of Google Analytics, and how it collects and processes data." If your site sends text messages through a service like Twilio, the phone carriers' registration for those texts is rejected without one. Twilio's error for it is titled "Privacy policy must disclose third-party data sharing", and the fix it asks for is a line that "mobile information will not be shared with third parties or affiliates for marketing or promotional purposes."

California's list is the one to write to, because it is short and it is specific. The policy has to:

• Say what you collect — the law asks it to "identify the categories of personally identifiable information that the operator collects" — and the kinds of outside companies it goes to.
• Explain how people can see or correct it, if you offer that.
• Say how you will tell people when the policy changes.
• Give its effective date.
• If the site tracks people across other websites, say how it responds to "Do Not Track" signals from browsers. "It does not" is an allowed answer.
• Say whether other companies can track visitors across other websites while they are on yours. If the page loads a Facebook pixel or Google ads tag, the answer is yes.

To write it, list every outside service your website touches: the company that emails you the contact form, the analytics, the booking widget, the payment processor, an embedded map or YouTube video, any ad platform's tag. Each one receives something about your visitors, even if only their address and the page they were on. That list is most of your privacy policy.

Here is where small businesses actually get into trouble. A free generator produces three thousand words: European data rights, a "data protection officer", a promise that "we never share your information with third parties". Meanwhile the site has a Facebook pixel on every page.

That is worse than having no policy. The Federal Trade Commission's guidance is that "like any other advertising claim, what you say about how you handle people's info has to be truthful, not deceptive, and backed up with objective proof." And California's law is broken not only by having no policy, but by not following the one you posted, whether knowingly or through carelessness that matters.

It happens without anybody lying. A site gains a booking widget, or loses a mailing list, and nobody touches the policy. This month I rewrote the privacy pages on six of my own sites by reading their code line by line, and every one that had a privacy page had at least one sentence in it that was no longer true — a clean-up job that was never actually running, an outside service the page did not mention, an email address on a domain the site did not own.

So: shorter, plainer and specific beats long and thorough. A one-page policy that names your actual tools is better than a long one that names none.

A cookie banner exists to ask permission before a site stores tracking cookies on somebody's device. That requirement comes from Europe, and Europe's privacy rules reach a business outside the EU when it offers goods or services to people in the EU, or monitors how they behave there. A Vancouver dog groomer is doing neither.

Google draws the same line for its own analytics and ads tags. Its consent policy covers "end users in the European Economic Area, the UK and Switzerland", and asks for consent to "the use of cookies or other local storage where legally required." None of the American laws in this article asks a local business for a banner.

What a banner does cost you: it covers the bottom of the page on a phone, right where the call button usually sits, and the paid consent tools add another script, and another monthly fee. And a banner cannot fix a privacy policy that is not true.

The simplest position of all is a site that sets no tracking cookies. Then there is nothing to ask permission for. If you do want analytics or ad tracking, that is a reasonable choice. Name it in the policy and leave the banner out, unless you are selling to people in Europe, in which case you need more advice than this article.

These are the laws the "compliance" emails are usually about:

• California's Consumer Privacy Act (CCPA) applies to businesses with gross annual revenue over a threshold set at $25 million and adjusted for inflation to $26,625,000 from 1 January 2025. It also catches any business that buys, sells or shares the personal information of "100,000 or more California residents or households", or makes half its revenue selling it.
• Oregon's Consumer Privacy Act, in force since 1 July 2024, applies to businesses that handle the personal data of "at least 100,000 consumers" in a year, or "25,000 or more consumers" while making over a quarter of their revenue from selling it. The Oregon Department of Justice points out that it applies to nonprofits as well.
• Washington has no general law like these. As the privacy profession's main association put it this month, "Olympia has not yet enacted its own comprehensive privacy law."

A salon, a contractor or a restaurant does not come close to any of those numbers. If somebody is selling you "CCPA compliance", ask which of the thresholds they think you meet. It is the same pattern as the accessibility widgets and the fake invoices: a real law, and a product that does not need to exist for a business your size.

Washington's My Health My Data Act took effect in 2024, and unlike the laws above, it does not let small businesses off. It defines a "small business" and gave it until 30 June 2024 to comply — three months more than everyone else. That was over two years ago.

It covers "consumer health data", which the Act defines as "personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status." The list that follows is long, and includes "individual health conditions, treatment, diseases, or diagnosis", "bodily functions, vital signs, symptoms, or measurements", "reproductive or sexual health information", "biometric data", and "data that identifies a consumer seeking health care services." The Attorney General adds that "any inferences drawn from purchases could be consumer health data."

Read that list against the forms on a local business's website:

• A massage therapist's booking form that asks where it hurts.
• A personal trainer's sign-up form that asks about injuries.
• A salon's booking form that asks about allergies before a colour.
• A med spa's consultation request that names the treatment.

Each of those, on a plain reading, is a Washington business collecting consumer health data. Healthcare providers already covered by HIPAA have an exemption for the patient records HIPAA covers. Exactly where that line falls for a provider's website is a question for their lawyer, not for me.

A separate health data privacy policy, linked from your home page. The Act says the business must "prominently publish a link to its consumer health data privacy policy on its homepage." The Attorney General's guidance adds that it "must be a separate and distinct link" and "may not contain additional information not required under the My Health My Data Act." Your ordinary privacy policy does not count. The health policy lists what health data you collect and why, where it comes from, what you share and with whom, and how people can use their rights under the Act.

Consent, in most cases. You may collect health data only with consent, or "to the extent necessary to provide a product or service" the person asked for. The injury question on a trainer's form plausibly falls under the second; a marketing list built from it does not. And consent means "a clear affirmative act", which the Act says cannot come from accepting "a general or broad terms of use agreement" — a box ticked beside "I agree to the terms" does not do it.

Separate consent to share it. Sharing health data needs consent "separate and distinct from the consent obtained to collect consumer health data", unless the sharing is needed to give people what they asked for. A company that handles the data for you under contract, such as your booking system, is not "sharing" under the Act; a company using it for its own purposes is.

That last point is where a website goes wrong without anyone noticing. A Facebook pixel or a Google Ads conversion tag on a page called "Thank you for booking your pelvic floor appointment" tells an advertising company that somebody on that phone booked that appointment. None of that is needed to give them the appointment.

Under the Act, "any violation of the Act is a per se violation of the Washington Consumer Protection Act", the Attorney General says, "which is enforced by the Attorney General as well as through private action." Private action means individuals can sue, not just the state. The first class action under the Act was filed in February 2025, against Amazon. Nobody needs to be Amazon to be the second.

1. Find your privacy policy. Is it linked from the bottom of every page? Does it have a date?
2. Read it next to your website. Does it name the services your site actually uses? Does it promise anything you do not do, such as "we never share"?
3. Count your tracking. Do you have Google Analytics, a Facebook pixel or an ads tag? If you are not sure, that is your answer: ask whoever built the site.
4. Read your forms. If you are in Washington and any form asks about health, injuries, allergies, symptoms or treatments, you need the separate health data policy and its home page link, and the pages behind those forms should not carry ad tags.

• I write the privacy policy, terms and accessibility statement as part of the build, not from a template, and link them from the footer.
• The privacy policy comes from what the site actually does: every cookie, every outside service a page loads, and every period data is kept for, checked against the code.
• My site audits read each privacy policy against the code again later. That is how the six sites I mentioned were caught.
• If you are in Washington and your site will ask about anything health related, tell me at the start. It changes what the forms ask, which pages carry which scripts, and what goes on your home page. For anything beyond that, you will want a lawyer, and I will say so.

You can read mine to see what a specific one looks like: it names every outside service this site uses, and what each one gets.