What is a Privacy Policy?

A Privacy Policy is a statement or a legal document that states how a company or website collects, handles and processes data of its customers and visitors. It explicitly describes whether that information is kept confidential, or is shared with or sold to third parties.

Personal information about an individual may include the following:

• Name
• Address
• Email
• Phone number
• Age
• Sex
• Marital status
• Race
• Nationality
• Religious beliefs

For example, an excerpt from Pinterest's Privacy Policy agreement clearly describes the information Pinterest collects from its users as well as from any other source that users enable Pinterest to gather information from. The information that the user voluntarily gives includes names, photos, pins, likes, email address, and/or phone number etc., all of which is regarded as personal information.

Additionally, Pinterest also states that it collects user location data from mobile devices, and if someone makes a purchase on Pinterest, payment and contact information - including an address and phone number - will be collected. If users buy products or services for others, Pinterest gathers their contact information and shipping details, too.

Users may also give Pinterest permission to access information that is shared with other websites like Facebook and Twitter by linking their Pinterest account with them. This information would also include information about their friends and followers. The account settings have information about how much access Pinterest has to their users' data.

In sum, a Privacy Policy is where you let your users know all about how you make sure their privacy is respected by your business practices.

Why you Need a Privacy Policy

Companies or websites that handle customer information are required by law and third parties to publish their Privacy Policies on their business websites. If you own a website, web app, mobile app or desktop app that collects or processes user data, you most certainly will have to post a Privacy Policy on your website (or give in-app access to the full Privacy Policy agreement).

Privacy is not a new concept. Humans have always desired privacy in their social as well as private lives. But the idea of privacy as a human right is a relatively modern phenomenon.

Around the world, laws and regulations have been developed for the protection of data related to government, education, health, children, consumers, financial institutions, etc.

This data is critical to the person it belongs to. From credit card numbers and social security numbers to email addresses and phone numbers, our sensitive, personally identifiable information is important. This sort of information in unreliable hands can potentially have far-reaching consequences.

There are several reasons for a website to post its Privacy Policy agreement on its website.

Here are some of the main reasons:

• Required by the law
• Required by third party services
• Increases Transparency

Let's take a look at each of these reasons in more depth.

A Privacy Policy is Required by the Law

For individuals to feel comfortable sharing their personal information on the internet, there should be some sort of legal responsibility on businesses to protect that data and keep the users informed about the status and health of their information.

Countries around the world have realized the need to protect their citizens' data and privacy. Businesses and websites that collect and/or process customer information are required to publish and abide by a Privacy Policy agreement.

A majority of countries have already enacted laws to protect their users' data security and privacy. These laws require businesses to obtain explicit consent from users whose data they will store or process.

A few of these laws include the following:

• CalOPPA in the USA
• GDPR in the EU
• PIPEDA in Canada

For a business or a website that collects and processes user information in a certain region or country, it is very important to have complete knowledge of the data and privacy protection laws enforced in that region and the region your customers and end users are in. Non-compliance with these laws can result in hefty fines or even prosecution against the violator.

In some cases, businesses have to follow laws specific to states or regulations specific to industries.

For example, here's how General Motors complies with CalOPPA in the US by including a California-specific section in its Privacy Policy:

General Motors informs its California users of their rights through its Privacy Policy as required by CalOPPA.

If your website/app reaches users around the world, regardless of where you're located or headquartered, you'll need to make sure you follow privacy laws in all applicable countries you reach.

While data protection and privacy laws differ from region to region, a Privacy Policy must comprehensively inform its users about how their data will be used.

For example, the GDPR is currently the most robust privacy legislation in the world and one of its main requirements for any business that falls under its jurisdiction is to have a GDPR-compliant Privacy Policy that contains some very specific information and is written in an easy-to-understand way.

Whether your website is a self-help blog or a game hosted at Google Play, it is your responsibility to give your end users complete information about how any associated third-parties will collect and process their data and (if possible) to what purpose.

A Privacy Policy is Required by Third Party Services

Apart from governing laws, some websites like Apple, Amazon, and Google require website and app owners to post a Privacy Policy agreement if they use any of their services.

Many websites and apps use in-page/in-app advertising by third parties to generate revenue. As these ads also collect user data, third parties require the websites or apps to ask their users' permission for sharing their personal data.

For example, if you're using Google Analytics on your website, the Google Analytics Terms of Service requires that you post a Privacy Policy agreement. In addition to this, you must also disclose that you're using Google Analytics and some information about how it collects and processes data:

If you are a Google app developer, the Privacy Policy Guidance requires that you inform your users about what data you collect, why you collect it, and what you do with it.

Some of the most popular third party services require website and app owners to post Privacy Policy agreements on their websites. Some of these services include:

• Amazon Affiliates
• ClickBank
• Google Play Store
• Google Analytics
• Google AdSense
• Google AdWords
• Facebook Apps
• Twitter Lead Generation
• Apple's App Store

Third party vendors like Google, Facebook, and Amazon require their users (website and app owners) to explicitly inform their users if they're using advertising features, cookies, or tracking services on their websites/apps in order to deliver better user experiences based on prior browsing behavior.

Here's how Ookla - a fixed broadband and mobile network testing company - informs its users in its Privacy Policy agreement that it uses cookies, log files, flash cookies, local storage, etc., in its website-based and mobile applications in order to (1) improve performance, (2) to better understand how Ookla's software functions, and (3) to give the user a personalized experience.

A Privacy Policy For Increased Transparency

Companies whose business models revolve around handling sensitive customer information find it incredibly important to establish trust with their users. A clear and comprehensive Privacy Policy agreement that tells users exactly what information the company collects and what it does with that information inspires confidence in a business. It gives users a sense of security knowing how much control they have over their personal data under the conditions they sign up for.

Your Privacy Policy agreement should inform your users about how your website or app handles their personal information. Your users must be also be informed about the reason for the collection of information, as well as how long their data will be stored on your servers.

Even if you don't collect personal information, you should disclose this fact in a Privacy Policy. It helps with transparency because users expect to see a Privacy Policy. If you don't have one at all, users may assume you're collecting a lot of personal information and not disclosing it rather than not collecting any.

The DuckDuckGo search engine does not track user searches or store online browsing history in any way. Its Privacy Policy agreement states that it does not collect or share any user information.

To make your Privacy Policy transparent and accurate, conduct a privacy law self-audit. This will allow you to find out what your business' privacy practices are and what information you need to disclose to your users in a Privacy Policy.

Example of a Website Privacy Policy

To be transparent with your users about what personal information you collect and what you do with it, you are required to publish a Privacy Policy agreement on your website or give in-app access to it.

Websites usually post a link to the complete Privacy Policy agreement from the footer of the website, whereas apps generally add the Privacy Policy to an "About" or "Legal" menu.

Another popular location for ecommerce store apps and websites is the checkout page, or account registration page if you don't have an ecommerce component but allow users to create accounts.