Do I need a privacy policy? Legal pages for an online store

Usually, yes. No single US federal law requires a privacy policy on every website, but California requires one from any commercial site that collects personal information from its residents, and Google, Meta and Stripe expect one before you use their tools. An online store also needs terms of sale, a refund and returns policy, a pre-order policy if it takes pre-orders, and a shipping policy.

This guide is for a founder selling a physical product online, often on pre-order, and covers US rules first. It is general information, not legal advice.

Do I need a privacy policy on my website?

In the US, the law that catches most small stores is California's Online Privacy Protection Act, known as CalOPPA (Cal. Bus. & Prof. Code §22575). It applies to any commercial website that collects personally identifiable information, such as a name, email address, street address or phone number, from people living in California. You can't stop Californians from ordering, so treat it as covering your store. It also covers a test page that only collects email addresses.

The policy must list the kinds of personal information you collect and the kinds of companies you share it with. It must also give its effective date, explain how you announce material changes, and say whether other companies can collect data about visitors' activity across sites when they use yours. If you collect that kind of data yourself, it must also say how you respond to "do not track" browser signals.

The FTC can take action against a company that breaks the promises in its privacy policy, as a deceptive practice under Section 5 of the FTC Act, so describe only what your store does.

California's broader privacy law, the CCPA, applies only to a business with gross annual revenue of $26,625,000 or more, one that buys, sells or shares the personal information of 100,000 or more California residents or households, or one that earns half its revenue from selling or sharing it (CPPA). Most small stores are below all three.

What Google, Meta and Stripe expect

• Google Analytics' terms require a privacy policy that says you use Google Analytics and cookies or similar technology to collect data.
• Google Ads requires advertisers who retarget past visitors to explain that Google and other vendors use cookies to show those ads, and how to opt out.
• Meta's Business Tools Terms require a clear notice on every page with a Meta pixel, linking to an explanation of how Meta and others collect data for ads and how to opt out.
• Stripe's website checklist lists a privacy policy among the things a site should show, along with refund, shipping and return policies and contact details. If it can't find your fulfillment policies or a way to contact you, Stripe says it may ask you to add them.
• Google Merchant Center, for listing products on Google Shopping, requires a return and refund policy and contact details, though its website rules don't mention a privacy policy.

If you sell to customers in the EU or UK

The EU's GDPR applies to a business outside the EU that offers goods to people in the EU (Article 3). Article 13 lists what you must tell people when you collect their data. Beyond who you are and who receives the data, it covers the purpose and legal basis for each use, how long you keep the data, any transfers outside the EU, and people's rights, including access, correction, deletion and complaining to a regulator.

The UK GDPR sets the same duties. The ICO, the UK regulator, says the information must be given when you collect the data, in clear and plain language. It also says you need consent before setting cookies that aren't essential, which includes ad pixels.

Under Article 27 of both versions, a store with no base in the EU or UK that sells there may also have to appoint a representative there in writing. The exemption covers only processing that is occasional and unlikely to put people at risk, so check it if you get regular orders from either.

If your business is in Australia

Australia's Privacy Act generally covers businesses with an annual turnover above A$3 million. The OAIC lists some it covers at any size, including health service providers and businesses that trade in personal information. A covered business needs a clearly expressed, up-to-date privacy policy. The small business exemption has been under review for years, so check the OAIC page before relying on it.

The legal pages an online store needs

Refunds, returns and pre-orders often share one page, and shipping can sit in the terms of sale.

A worked example: a phone stand sold on pre-order

The numbers are invented and round. A founder in Ohio sells a walnut phone stand for $40. Her test page collected 300 email addresses, and her first pre-order run took 120 orders: 96 from the US (14 of them from California), 18 from the UK and 6 from Germany. She uses Stripe, a Meta pixel, Google Analytics and an email tool.

1. List where your customers live and which tools see their data

List every country you ship to and every company that receives customer data, from the payment processor and website host to ad pixels and delivery companies. Each goes in your privacy policy.

For the founder, 24 of her 120 orders, or 20%, came from the UK and Germany, so the UK GDPR and the GDPR apply as well as the US rules.

2. Write each page to the strictest market you sell into

For each topic, find the strictest rule among the places you sell to and give that to every customer. You're allowed to give customers more than a law requires. If a market's rules are more than you want to take on, stop shipping there.

The US pre-order rule is the FTC's Mail, Internet, or Telephone Order Merchandise Rule. You need a reasonable basis for the ship date you give, or for shipping within 30 days if you give none. If you can't ship on time, you must offer customers the choice of a new date or canceling for a full refund before the original date passes. After a cancellation, you have seven working days to refund a charged card, or to confirm in writing that a saved card you never charged won't be. Under the UK's Consumer Contracts Regulations 2013, a customer can cancel from the moment they order until 14 days after the goods arrive.

3. Write the privacy policy from your list

For each kind of data, say what it is, why you collect it and who receives it. A checkout collects names, addresses, email addresses and order details; analytics and pixels record what visitors do. For EU and UK customers, add the Article 13 details listed above. Finish with the effective date, an email address for privacy questions and how you'll announce changes.

The founder names Stripe, Meta, Google and her email tool, and explains how to opt out of Meta's and Google's ad cookies.

4. Write the terms of sale

Include your legal name and business address, how an order is accepted, prices and currency, taxes and import duties, delivery, and the law that governs the terms. If you trade under a brand name as a sole proprietor or an LLC, use the legal name of the person or company that makes the sale.

Leave out anything that limits reviews. The FTC says the Consumer Review Fairness Act bars form contracts that restrict honest reviews, penalize customers for posting them or take the rights to what they write.

5. Write the refund, returns and pre-order policy

New York requires online retailers to post their refund policy next to the item or before customers enter billing details, so show it at checkout as well as in the footer. How to set a ship-by date, when to charge and what to do if the date slips are covered in how to take pre-orders.

The sample below is a starting point to adapt to your store, not legal advice.

Refunds, returns and pre-orders. Last updated [date].



Pre-orders: Each pre-order item shows its ship-by date. We save your card when you order and charge it only if production goes ahead. If it doesn't, we cancel every order and your card is never charged. Until your order leaves us, you can cancel it by emailing [email]. Within 7 working days we'll refund everything you paid, or confirm that your card won't be charged. If the date is going to slip, we'll email you before it does with a new date and the option to cancel instead.



Changed your mind: Send any item back within 30 days of delivery. Email us first for the return address. Return postage is yours to pay. Within 14 days of your email, we refund what you paid for the item plus the original standard delivery charge. We may wait until the item reaches us, or until you send proof of postage, before we pay.



Faulty, damaged or wrong items: Tell us, and choose a replacement or a refund. We also refund any postage you paid.



Refunds go back to the card or account you paid with. This policy adds to your rights under the law where you live and doesn't take any away.

The founder saves each customer's card at checkout and charges the cards only once the run goes ahead. Her 120 pre-orders total 120 × $40 = $4,800, and from the day she charges them she keeps that much available until every order ships, so she can refund any cancellation within seven working days.

6. Publish the pages and keep them matching

Link every page from the site footer, and the refund and pre-order terms from the checkout. If you'd rather start from a filled-in draft, Draper's Legal Documents workshop writes the privacy policy, terms and refund policy from what you've already told it about the business.

When your setup changes, for example a new ad tool or a new country on the shipping list, update the pages and the date at the top.

Products and stores with extra rules

• Subscriptions, digital downloads and services have their own cancellation and billing rules.
• Electrical goods, toys, cosmetics, supplements and food have labeling and safety rules of their own.
• Goods made to the customer's specifications or clearly personalized, such as an engraved stand, are exempt from the EU and UK 14-day right to cancel (Article 16(c) of the EU Consumer Rights Directive, and regulation 28 of the UK regulations). Your returns policy should name the items it covers.
• If you sell only through a marketplace such as Etsy or Amazon, its checkout and policies govern the sale. You still need a privacy policy for any site or email list you run yourself.

Related questions

Whose name goes on these pages depends on your structure: see LLC vs sole proprietor. The steps before a store needs any of this, from a test page to the first pre-order, start with testing demand before you build.