In today’s digital age, it is essential for all websites to have a clear and concise privacy policy in place. This document not only protects the website owner and operator, but it also serves as a transparent and honest communication with the website’s users and visitors. There are several critical disclosures that should be included in every privacy policy, including those related to Google Analytics, the General Data Protection Regulation (GDPR), and the ability for users to opt-out of data tracking.
Google Analytics Disclosure:
Google Analytics is a popular web analytics service that tracks and reports website traffic. It is used by millions of websites around the world to analyze user behavior and understand how visitors interact with their site. While Google Analytics is a valuable tool for website owners, it is important to disclose its use in the privacy policy. This can be done by including a statement such as:
“This website uses Google Analytics, a web analytics service provided by Google, Inc. (Google). Google Analytics uses cookies, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.”
This disclosure not only explains how Google Analytics works, but it also informs users that their data may be transferred to third parties and that they have the option to opt-out of cookie tracking by adjusting their browser settings.
Google Analytics Opt-Out:
In addition to disclosing the use of Google Analytics in the privacy policy, it is important to provide users with the option to opt-out of data tracking. This can be done by including a link to the Google Analytics opt-out browser extension. This extension allows users to opt-out of data collection by Google Analytics on all websites that use the service. To add this to the privacy policy, include a statement such as:
“You may choose to opt-out of Google Analytics tracking by installing the Google Analytics opt-out browser extension, which is available at this link: https://tools.google.com/dlpage/gaoptout.”
GDPR Disclosures:
The General Data Protection Regulation (GDPR) is a data protection law that went into effect on May 25, 2018. It applies to all organizations that process the personal data of individuals within the European Union (EU), regardless of the organization’s location. If a website processes the personal data of EU citizens, it must comply with the GDPR and include specific disclosures in the privacy policy. These disclosures should include:
- A clear and concise statement explaining the purpose for collecting and processing personal data.
- The legal basis for collecting and processing personal data.
- The categories of personal data being collected and processed.
- How long the personal data will be retained.
- The rights of individuals under the GDPR, including the right to access, rectify, erase, restrict, object to, or withdraw consent to processing of their personal data.
- The right to file a complaint with a supervisory authority.
- The existence of automated decision-making, including profiling, and the consequences of such processing.
- Any transfers of personal data to third countries or international organizations, including the appropriate safeguards in place to protect the data.
Here is an example of how these disclosures could be included in a privacy policy:
“As required by the General Data Protection Regulation (GDPR), we have provided the following information about our collection and processing of personal data.
Purpose: We collect and process personal data for the following purposes: [list purposes].
Legal basis: The legal basis for collecting and processing personal data is [consent/contract/legal obligation/vital interests/public interest/legitimate interests].
Categories of data: The categories of personal data we collect and process include: [list categories].
Retention period: Personal data will be retained for [specific period or criteria for determining retention period].
Rights of individuals: Under the GDPR, individuals have the following rights with regard to their personal data:
- The right to access their personal data.
- The right to rectify their personal data if it is inaccurate or incomplete.
- The right to erase their personal data in certain circumstances.
- The right to restrict the processing of their personal data in certain circumstances.
- The right to object to the processing of their personal data in certain circumstances.
- The right to withdraw consent at any time, if the legal basis for processing is consent.
Complaints: If you have a concern about our collection and processing of personal data, you have the right to file a complaint with a supervisory authority.
Automated decision-making: We do not use automated decision-making, including profiling, in relation to personal data.
Transfers of personal data: We do not transfer personal data to third countries or international organizations.
Safeguards: We have implemented appropriate safeguards to protect personal data, including [list safeguards in place].”
COPPA: Children's Online Privacy Protection Act
The Children’s Online Privacy Protection Act (COPPA) is a federal law in the United States that regulates the collection of personal information from children under the age of 13. If a website is directed towards children or has actual knowledge that it is collecting personal information from children under 13, it must comply with COPPA. This includes having a clear and concise privacy policy in place that meets the requirements of the COPPA Rule.
To comply with COPPA, a website’s privacy policy should include:
- A statement that the website is intended for a general audience and not directed towards children under 13.
- If the website is directed towards children or has actual knowledge that it is collecting personal information from children under 13, a statement that the website is in compliance with COPPA and that it has obtained verifiable parental consent for the collection of personal information from children under 13.
- A description of the types of personal information that is collected from children, including how it is collected, used, and shared.
- A description of the measures taken to protect the confidentiality, security, and integrity of personal information collected from children.
- A description of the options that are available to parents for reviewing and/or deleting their child’s personal information, as well as the ability to refuse to allow further collection or use of the child’s personal information.
Here is an example of how these disclosures could be included in a privacy policy:
“This website is intended for a general audience and is not directed towards children under 13. If you are under 13, please do not provide any personal information to us. If we discover that a child under 13 has provided us with personal information, we will delete such information from our database.
If this website is directed towards children or has actual knowledge that it is collecting personal information from children under 13, we are in compliance with the Children’s Online Privacy Protection Act (COPPA) and have obtained verifiable parental consent for the collection of personal information from children under 13.
We collect the following types of personal information from children: [list types of personal information collected]. This information is used for the following purposes: [list purposes for collecting personal information]. We may share this information with the following third parties: [list third parties with whom personal information may be shared].
We take measures to protect the confidentiality, security, and integrity of personal information collected from children. These measures include: [list measures taken to protect personal information].
Parents have the option to review and delete their child’s personal information, as well as the ability to refuse to allow further collection or use of their child’s personal information. To exercise these options, please contact us at [contact information].”
HIPAA: Health Insurance Portability and Accountability Act
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law in the United States that regulates the collection, use, and disclosure of personal health information. It applies to covered entities, including healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates. If a website is a covered entity or business associate under HIPAA, it must comply with the HIPAA Privacy Rule and have a privacy policy in place that meets the requirements of the Rule.
To comply with HIPAA, a website’s privacy policy should include:
- A statement that the website is a covered entity or business associate under HIPAA and is committed to protecting the privacy of personal health information.
- A description of the types of personal health information that is collected and how it is collected, used, and disclosed.
- A description of the measures taken to protect the confidentiality, security, and integrity of personal health information.
- A description of the rights of individuals with regard to their personal health information, including the right to access, amend, and request restrictions on the use and disclosure of their information.
- A description of how individuals can exercise their rights and how the website will respond to requests.
- A description of how individuals can file a complaint if they believe their privacy rights have been violated.
Here is an example of how these disclosures could be included in a privacy policy:
“We are a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA) and are committed to protecting the privacy of personal health information.
We collect the following types of personal health information: [list types of personal health information collected]. This information is used for the following purposes: [list purposes for collecting personal health information]. We may disclose this information to the following parties: [list parties with whom personal health information may be disclosed].
We take measures to protect the confidentiality, security, and integrity of personal health information. These measures include: [list measures taken to protect personal health information].
Under HIPAA, individuals have the following rights with regard to their personal health information:
- The right to access their personal health information.
- The right to request amendments to their personal health information if it is inaccurate or incomplete.
- The right to request restrictions on the use and disclosure of their personal health information.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by HIPAA.
If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services. To file a complaint with us, please contact us at [contact information].”
California CalOPPA: California Online Privacy Protection Act
The California Online Privacy Protection Act (CalOPPA) is a state law in California that requires all websites that collect personal information from California residents to post a privacy policy. The privacy policy must be conspicuously displayed on the website and must provide certain information to users.
To comply with CalOPPA, a website’s privacy policy should include:
- A description of the types of personal information that is collected and how it is collected, used, and disclosed.
- A description of how individuals can access, change, or delete their personal information.
- A description of how the website will notify individuals of any changes to the privacy policy.
- A statement that the privacy policy applies to all users of the website, regardless of their location.
Here is an example of how these disclosures could be included in a privacy policy:
“We collect the following types of personal information: [list types of personal information collected]. This information is used for the following purposes: [list purposes for collecting personal information]. We may disclose this information to the following parties: [list parties with whom personal information may be disclosed].
You have the right to access, change, or delete your personal information. To exercise these rights, please contact us at [contact information].
We reserve the right to modify this privacy policy at any time. If we make changes to the policy, we will post the updated policy on this page and update the effective date. We encourage you to review the policy periodically.
This privacy policy applies to all users of our website, regardless of their location.”
California CCPA: California's Consumer Privacy Act:
The California Consumer Privacy Act (CCPA) is a state law in California that went into effect on January 1, 2020. It gives California consumers the right to know what personal information is being collected about them, the right to request that their personal information be deleted, and the right to opt-out of the sale of their personal information. If a website collects personal information from California consumers and meets certain thresholds, it must comply with the CCPA and include specific disclosures in its privacy policy.
To comply with the CCPA, a website’s privacy policy should include:
- A description of the categories of personal information that is collected and the sources from which it is collected.
- A description of the purposes for which the personal information is used.
- A description of the categories of third parties with whom the personal information is shared.
- A description of the rights of California consumers under the CCPA, including the right to access their personal information, the right to request that their personal information be deleted, and the right to opt-out of the sale of their personal information.
- A description of how California consumers can exercise their rights under the CCPA and how the website will respond to requests.
- A description of any financial incentives offered by the website in exchange for the collection, sale, or retention of personal information.
- A description of the security measures in place to protect personal information.
Here is an example of how these disclosures could be included in a privacy policy:
“We collect the following categories of personal information: [list categories of personal information collected] and obtain it from the following sources: [list sources from which personal information is collected].
We use personal information for the following purposes: [list purposes for using personal information].
We share personal information with the following categories of third parties: [list categories of third parties with whom personal information is shared].
California consumers have the following rights under the California Consumer Privacy Act (CCPA):
- The right to request access to their personal information.
- The right to request that their personal information be deleted.
- The right to opt-out of the sale of their personal information.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by the CCPA.
We do not offer financial incentives in exchange for the collection, sale, or retention of personal information.
We have implemented appropriate security measures to protect personal information, including: [list security measures in place].”
California CPRA: California's Privacy Rights Act:
The California Privacy Rights Act (CPRA) is a state law in California that expands upon the California Consumer Privacy Act (CCPA). It gives California consumers additional rights with regard to their personal information, including the right to opt-in to the sale of sensitive personal information and the right to equal service and price, regardless of whether they exercise their privacy rights. If a website collects personal information from California consumers and meets certain thresholds, it must comply with the CPRA and include specific disclosures in its privacy policy.
To comply with the CPRA, a website’s privacy policy should include:
- A description of the categories of sensitive personal information that is collected and the sources from which it is collected.
- A description of the purposes for which the sensitive personal information is used.
- A description of the categories of third parties with whom the sensitive personal information is shared.
- A description of the rights of California consumers under the CPRA, including the right to opt-in to the sale of sensitive personal information and the right to equal service and price, regardless of whether they exercise their privacy rights.
- A description of how California consumers can exercise their rights under the CPRA and how the website will respond to requests.
Here is an example of how these disclosures could be
included in a privacy policy:
“We collect the following categories of sensitive personal information: [list categories of sensitive personal information collected] and obtain it from the following sources: [list sources from which sensitive personal information is collected].
We use sensitive personal information for the following purposes: [list purposes for using sensitive personal information].
We share sensitive personal information with the following categories of third parties: [list categories of third parties with whom sensitive personal information is shared].
California consumers have the following rights under the California Privacy Rights Act (CPRA):
- The right to opt-in to the sale of sensitive personal information.
- The right to equal service and price, regardless of whether they exercise their privacy rights.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by the CPRA.
We do not sell sensitive personal information without obtaining prior opt-in consent from California consumers. We also provide equal service and price to all California consumers, regardless of whether they exercise their privacy rights under the CPRA.”
Virginia CDPA: Virginia's Consumer Data Protection Act:
The Virginia Consumer Data Protection Act (CDPA) is a state law in Virginia that went into effect on January 1, 2021. It gives Virginia consumers the right to know what personal data is being collected about them, the right to request that their personal data be deleted, and the right to opt-out of the sale of their personal data. If a website collects personal data from Virginia consumers and meets certain thresholds, it must comply with the CDPA and include specific disclosures in its privacy policy.
To comply with the CDPA, a website’s privacy policy should include:
- A description of the categories of personal data that is collected and the sources from which it is collected.
- A description of the purposes for which the personal data is used.
- A description of the categories of third parties with whom the personal data is shared.
- A description of the rights of Virginia consumers under the CDPA, including the right to access their personal data, the right to request that their personal data be deleted, and the right to opt-out of the sale of their personal data.
- A description of how Virginia consumers can exercise their rights under the CDPA and how the website will respond to requests.
- A description of any financial incentives offered by the website in exchange for the collection, sale, or retention of personal data.
- A description of the security measures in place to protect personal data.
Here is an example of how these disclosures could be included in a privacy policy:
“We collect the following categories of personal data: [list categories of personal data collected] and obtain it from the following sources: [list sources from which personal data is collected].
We use personal data for the following purposes: [list purposes for using personal data].
We share personal data with the following categories of third parties: [list categories of third parties with whom personal data is shared].
Virginia consumers have the following rights under the Virginia Consumer Data Protection Act (CDPA):
- The right to access their personal data.
- The right to request that their personal data be deleted.
- The right to opt-out of the sale of their personal data.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by the CDPA.
We do not offer financial incentives in exchange for the collection, sale, or retention of personal data.
We have implemented appropriate security measures to protect personal data, including: [list security measures in place].”
Maryland PIPA: Maryland's Personal Information Protection Act:
The Maryland Personal Information Protection Act (PIPA) is a state law in Maryland that went into effect on January 1, 2020. It gives Maryland consumers the right to know what personal information is being collected about them, the right to request that their personal information be deleted, and the right to opt-out of the sale of their personal information. If a website collects personal information from Maryland consumers and meets certain thresholds, it must comply with PIPA and include specific disclosures in its privacy policy.
To comply with PIPA, a website’s privacy policy should include:
- A description of the categories of personal information that is collected and the sources from which it is collected.
- A description of the purposes for which the personal information is used.
- A description of the categories of third parties with whom the personal information is shared.
- A description of the rights of Maryland consumers under PIPA, including the right to access their personal information, the right to request that their personal information be deleted, and the right to opt-out of the sale of their personal information.
- A description of how Maryland consumers can exercise their rights under PIPA and how the website will respond to requests.
- A description of any financial incentives offered by the website in exchange for the collection, sale, or retention of personal information.
- A description of the security measures in place to protect personal information.
Here is an example of how these disclosures could be included in a privacy policy:
“We collect the following categories of personal information: [list categories of personal information collected] and obtain it from the following sources: [list sources from which personal information is collected].
We use personal information for the following purposes: [list purposes for using personal information].
We share personal information with the following categories of third parties: [list categories of third parties with whom personal information is shared].
Maryland consumers have the following rights under the Maryland Personal Information Protection Act (PIPA):
- The right to access their personal information.
- The right to request that their personal information be deleted.
- The right to opt-out of the sale of their personal information.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by PIPA.
We do not offer financial incentives in exchange for the collection, sale, or retention of personal information.
We have implemented appropriate security measures to protect personal information, including: [list security measures in place].”
Quebec's Bill 64
Bill 64 is a privacy law in the province of Quebec, Canada that went into effect on January 1, 2021. It gives Quebec consumers the right to know what personal information is being collected about them, the right to request that their personal information be corrected or deleted, and the right to withdraw their consent for the collection, use, and disclosure of their personal information. If a website collects personal information from Quebec consumers and meets certain thresholds, it must comply with Bill 64 and include specific disclosures in its privacy policy.
To comply with Bill 64, a website’s privacy policy should include:
- A description of the categories of personal information that is collected and the sources from which it is collected.
- A description of the purposes for which the personal information is used.
- A description of the categories of third parties with whom the personal information is shared.
- A description of the rights of Quebec consumers under Bill 64, including the right to access their personal information, the right to request that their personal information be corrected or deleted, and the right to withdraw their consent for the collection, use, and disclosure of their personal information.
- A description of how Quebec consumers can exercise their rights under Bill 64 and how the website will respond to requests.
- A description of the measures in place to protect the security and confidentiality of personal information.
Here is an example of how these disclosures could be included in a privacy policy:
“We collect the following categories of personal information: [list categories of personal information collected] and obtain it from the following sources: [list sources from which personal information is collected].
We use personal information for the following purposes: [list purposes for using personal information].
We share personal information with the following categories of third parties: [list categories of third parties with whom personal information is shared].
Quebec consumers have the following rights under Bill 64:
- The right to access their personal information.
- The right to request that their personal information be corrected or deleted.
- The right to withdraw their consent for the collection, use, and disclosure of their personal information.
To exercise these rights, please contact us at [contact information]. We will respond to your request within the time frame required by Bill 64.
We take measures to protect the security and confidentiality of personal information, including: [list measures in place to protect personal information].”
Including critical disclosures in a privacy policy is essential for any website that collects and processes personal data. These disclosures not only protect the website owner and operator, but they also serve as a transparent and honest communication with the website’s users and visitors. These disclosures may include information about the types of personal information collected, how it is used and disclosed, and the rights of individuals with regard to their personal information. By including these disclosures, websites can build trust with their users and demonstrate their commitment to protecting their privacy.
Please note that the above information is not intended as legal advice and it is recommended that all website owners have their privacy policy reviewed by a local privacy lawyer to ensure compliance with applicable laws and regulations. The specific requirements for a privacy policy may vary depending on the location and nature of the website and it is important to seek professional legal guidance to ensure that all necessary disclosures are included.
