Skip to main content

    Privacy Policy Generator

    Generate a free starter privacy policy template covering common website, analytics, cookie, and contact-form topics.

    Free to use. Runs in your browser.

    Answer a short questionnaire about your site to generate a starter privacy policy template. It is not legal advice or a compliance certificate, so have it reviewed before publishing.

    Tick every type of data you collect, including analytics and cookies from embedded third-party scripts, and list each external service (such as Google Analytics or Stripe) so the policy names every processor.

    Company Details

    What data do you collect?

    Preview

    # Privacy Policy **Effective Date:** [Date] ## 1. Introduction Welcome to [Your Company]. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you visit [Your Website URL]. ## 2. Information We Collect ### Personal Information We may collect personal information that you voluntarily provide, including: - Name and email address - Contact information - Any other information you choose to provide ### Usage Data We automatically collect certain information when you visit our website, including: - IP address (anonymised where possible) - Browser type and version - Pages visited and time spent - Referring website - Device information ### Cookies We use cookies and similar tracking technologies to enhance your experience. You can control cookies through your browser settings. Types of cookies we use: - **Essential cookies:** Required for the website to function properly - **Analytics cookies:** Help us understand how visitors use our site - **Preference cookies:** Remember your settings and preferences ## 3. How We Use Your Information We use the information we collect to: - Provide and maintain our services - Improve and personalise your experience - Communicate with you about updates and changes - Ensure security and prevent fraud - Comply with legal obligations ## 4. Legal Basis for Processing (GDPR) If you are in the European Economic Area (EEA), we process your data based on: - **Consent:** Where you have given explicit consent - **Legitimate interest:** For analytics and service improvement - **Contractual necessity:** To fulfil our obligations to you - **Legal obligation:** To comply with applicable laws ## 5. Data Sharing We do not sell your personal data. We may share information with: - Third-party service providers: Google Analytics - Legal authorities when required by law - Business partners with your explicit consent ## 6. Data Retention We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. ## 7. Your Rights You have the right to: - **Access** your personal data - **Correct** inaccurate data - **Delete** your data ("right to be forgotten") - **Object** to or **restrict** processing - **Data portability**: receive your data in a structured format - **Withdraw consent** at any time To exercise these rights, contact us at [your contact email]. ## 8. Security We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. ## 9. Children's Privacy Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. ## 10. Changes to This Policy We may update this privacy policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the effective date. ## 11. Contact Us If you have questions about this privacy policy, please contact us at: - **Email:** [your contact email] - **Website:** [Your Website URL] --- *Starter template only. This privacy policy is not legal advice or a compliance certificate. Have it reviewed by a qualified legal professional before publishing.*

    General information only. This generator produces a starter privacy policy template, not legal advice or a compliance certificate. Privacy law differs by jurisdiction and by how your site handles data. Have the policy reviewed by a qualified solicitor or data-protection professional, and check guidance from the ICO (UK) or your national regulator, before publishing.

    Methodology and sources

    Formula or method

    Assembles a plain-text Markdown privacy policy by concatenating hardcoded clause blocks. A short questionnaire (5 checkboxes and 5 text fields) controls which sections are included. The output is a fixed-structure starter template; no regulatory database, API, or AI model is involved. The user supplies all identifiers (company name, URL, contact email, effective date, third-party services). Section numbering shifts automatically when the user-accounts section is included.

    Basis and assumptions

    • All clause text is hardcoded string literals in the tool source; the template is not updated automatically when law changes.
    • The GDPR lawful-basis section (Section 4) is always included regardless of jurisdiction; users outside the EEA should remove or adapt it.
    • Third-party service names are entered free-form by the user; the tool does not validate them or check whether a processor agreement is required.
    • The children's privacy age threshold is hardcoded at 16 (UK GDPR / GDPR default); COPPA (USA) sets this at 13, which the template does not distinguish.
    • Effective date defaults to today's date (set via useEffect after the prerender flag check); the user may override it.
    • No section covers international data transfers (Standard Contractual Clauses, adequacy decisions) or data-breach notification procedures.

    Key handling decisions

    • Prerender guard: effectiveDate is initialised as an empty string and populated in a useEffect that bails if window.__IFORGE_PRERENDER__ is true, preventing clock drift in the HTML fragment.
    • Section numbering: sections 9-12 are numbered via ternary on hasUserAccounts so numbering stays sequential regardless of which optional sections are active.
    • Output format: Markdown only; the user must convert to HTML separately (a link to the Markdown-to-HTML tool is provided in the content section).

    What this tool does not decide

    • Whether the generated text makes your site legally compliant. A qualified solicitor or data-protection lawyer should review the policy before you publish it.
    • Which lawful basis for processing applies to your specific data activities. A Data Protection Officer (DPO) or qualified solicitor should advise on this.
    • Whether your organisation is a controller or processor under UK GDPR / EU GDPR, or whether you need a Record of Processing Activities (ROPA). Seek advice from the UK ICO or a qualified solicitor.
    • CCPA / CPRA applicability thresholds (annual revenue, number of consumers, or data sold). A US-qualified attorney familiar with California privacy law should advise on this.
    • Whether a Data Protection Impact Assessment (DPIA) is required for your processing activities. Consult a qualified DPO or solicitor.
    • Cookie-consent banner requirements (separate from the policy). The UK ICO and EU Data Protection Authorities set guidance on this; a solicitor or compliance specialist should advise.

    Sources

    Last checked: 2026-06-17

    Why Every Website Needs a Privacy Policy

    If your website collects any data at all, even anonymous analytics, you legally need a privacy policy in most jurisdictions. GDPR (Europe), CCPA (California), LGPD (Brazil), POPIA (South Africa), the UK Data Protection Act, and Australia's Privacy Act 1988 all require clear disclosure of what data you collect and how you use it.

    Beyond legal compliance, a privacy policy builds trust. Users are increasingly privacy-conscious, and a clear, honest policy signals that you take their data seriously. Google also requires a privacy policy for sites using AdSense, Analytics, or any Google API.

    Privacy Law Comparison

    RegulationRegionKey RequirementMax Fine
    GDPREU / EEAExplicit consent, right to deletion, data portability€20M or 4% global revenue
    UK GDPRUnited KingdomMirrors EU GDPR post-Brexit with ICO enforcement£17.5M or 4% revenue
    CCPA / CPRACalifornia, USARight to know, delete, opt-out of sale$7,500 per intentional violation
    LGPDBrazilSimilar to GDPR with local data authority (ANPD)2% of revenue, up to R$50M
    POPIASouth AfricaLawful processing conditions, data subject rightsR10M or imprisonment
    PIPEDACanadaMeaningful consent, accountability principleCAD $100,000 per violation
    Privacy Act 1988 + APPsAustralia13 Australian Privacy Principles, Notifiable Data Breaches scheme, OAIC enforcementAUD $50M or 3x benefit or 30% turnover (whichever is greater)

    What this means for you: If your website is accessible globally (and most are), you should comply with the strictest regulation that applies to your users. In practice, building for GDPR compliance covers most other regulations.

    What Your Privacy Policy Must Cover

    What Data You Collect

    Be specific. "We collect personal information" is too vague. List categories: names, emails, IP addresses, browser type, cookies, payment data. If you use analytics, say which provider.

    Why You Collect It

    GDPR requires a "lawful basis" for each type of processing: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Most websites use consent and legitimate interests.

    Who You Share It With

    Name your third-party processors: Google Analytics, Stripe, Mailchimp, cloud hosting providers. Users have a right to know who else accesses their data.

    User Rights

    Under GDPR: access, rectification, erasure, restriction, portability, and objection. Under CCPA: know, delete, opt-out of sale. Provide a clear way to exercise these rights (email, form, or in-app).

    Cookie Categories You Must Disclose

    CategoryConsent Needed?Examples
    Strictly necessaryNo (exempt)Session cookies, CSRF tokens, login state
    Analytics / PerformanceYes (GDPR)Google Analytics, Hotjar, Plausible
    Functional / PreferencesYes (GDPR)Language preference, theme choice, saved filters
    Advertising / TargetingYes (always)Google Ads, Facebook Pixel, retargeting tags

    Under GDPR and the UK PECR, you must get active consent before setting non-essential cookies. Pre-ticked boxes don't count. Your cookie banner must allow genuine choice, "Accept All" without an equally prominent "Reject All" violates the spirit of the law.

    Related Tools

    Terms & Conditions Generator

    Generate T&C to pair with your privacy policy.

    Meta Tag Generator

    Add meta tags to your privacy policy page for SEO.

    Robots.txt Generator

    Control which pages search engines can crawl on your site.

    Markdown to HTML

    Convert the generated Markdown policy to HTML for your website.

    Sitemap Generator

    Include your privacy policy URL in your sitemap.

    Schema Markup Generator

    Add WebPage schema to your legal pages.

    How to use this tool

    1

    Enter your company details

    2

    Select which data you collect

    3

    Preview and copy or download the policy

    Common uses

    • Drafting a starter privacy policy for a new website
    • Preparing privacy-policy text for SaaS products and mobile apps
    • Updating an existing policy when adding new data collection methods
    • Collecting privacy-policy details before legal review

    Share this tool

    Frequently Asked Questions

    Is this privacy policy legally binding?
    This generator creates a starter template covering common privacy-policy topics. Have a qualified legal professional review and customise it for your jurisdiction, business model, and actual data practices before publishing.
    Does this cover GDPR?
    The generated policy includes GDPR-related topics such as data subject rights, lawful basis for processing, and data retention. A privacy policy alone does not make a site GDPR, UK GDPR, or CCPA compliant.
    Can I use this for free?
    Yes. The generated policy is completely free to use and modify. No attribution is required.
    Do I need a privacy policy if I don't collect personal data?
    If you use analytics (even anonymous), cookies, or any third-party scripts that may track users, you should have a privacy policy. Most websites collect more data than they realise through embedded services.
    What's the difference between GDPR and CCPA?
    GDPR and UK GDPR set data-protection duties around transparency, lawful basis, individual rights, and security. CCPA and CPRA focus on California consumer privacy rights, including notice, access, deletion, correction, and opt-out rights for covered businesses.
    How often should I update my privacy policy?
    Update whenever you change how you collect, use, or share data. At minimum, review it annually. Adding a new analytics tool, payment processor, or marketing service all require an update.
    Where should I display my privacy policy?
    Link to it in your website footer (visible on every page), during account registration, at checkout, and in any forms that collect personal data. GDPR requires the link to be easily accessible.
    Does this cover cookie consent?
    The generated policy includes a cookies section if you select that option. However, you'll also need a cookie consent banner (separate from the policy) to comply with the EU ePrivacy Directive.
    Can I download the policy?
    Yes. Click 'Download .md' to get the policy as a Markdown file. You can convert it to HTML using our Markdown to HTML converter, or paste it directly into most CMS platforms.
    What third-party services should I disclose?
    List all services that process user data on your behalf: analytics (Google Analytics), payment (Stripe, PayPal), email (Mailchimp), hosting (AWS, Cloudflare), advertising, and social media plugins.
    Is my data stored when I generate a policy?
    No. Everything runs in your browser. Your company details and policy content are never uploaded or stored anywhere.
    Do I need a separate cookie policy?
    It depends on your jurisdiction. Under GDPR/ePrivacy, a separate cookie policy or a detailed cookie section within your privacy policy is required. The UK ICO recommends a standalone cookie policy.

    Results are for general informational purposes only and should be checked before use. They are not professional advice. See our Disclaimer and Terms of Service.