Privacy Policy 101: What Your Website Legally Needs
You know those tiny links at the very bottom of a website? The ones that say "Privacy Policy" and "Terms & Conditions"? The ones you've never actually clicked?
Yeah. We need to talk about those.
In Episode 11 of Life Is Legal, Brooke sits down with Cari Kaufman — fractional Chief Storytelling Officer at Storyteller Wordsmith and a Certified Data Privacy Partner — to pull back the curtain on the "throwaway pages" that aren't throwaway at all. If you have a website, run a blog, collect email addresses, or just exist on the internet as a human being, this one's for you.
Your Website Is Already Collecting Data — Whether You Know It or Not
Here's the thing most business owners don't realize: the moment someone lands on your website, data collection begins. We're not just talking about the contact form where someone types in their name and email. We're talking about:
IP addresses and location data
Browsing behavior and traffic patterns
Search terms that brought someone to your site
Data collected by any third-party tools running in the background — Google Analytics, Meta Pixel, embedded YouTube videos, your Instagram feed, scheduling tools, and more
That last one tends to catch people off guard. If you have Google Analytics installed (and most websites do), you are sharing your visitors' data with Google. That's not inherently bad — but you are legally required to disclose it.
"You have to tell people, 'Hey, I do have these things turned on on my website. So when you come to this website, you are agreeing to allow me to collect that information.'"
— Cari Kaufman
The Four Legal Pages Every Website Needs
Most people know they're "supposed to have" a privacy policy. Fewer people know there are actually four legal pages that should live in your website footer:
Privacy Policy — tells visitors what data you collect, how you store it, and what you do with it
Cookie Policy — discloses that your site uses cookies and what kind of tracking they enable
Disclaimer — limits your legal liability around your content
Terms & Conditions — protects your business's legal rights (return policies, dispute resolution, etc.)
You need all four. Even if you have a one-page website. Even if you're "just a blogger." Even if you only have a newsletter signup form that collects one email address.
That last one is where people really get tripped up.
One Email Address = A Federal Legal Obligation
Collecting even a single email address on your website means you are collecting Personally Identifiable Information (PII). That comes with a federal liability — you are legally required to disclose what you are doing with it, how it is being stored, and who else might have access to it.
And if you don't? There are bots out there actively crawling websites, specifically looking for sites that collect data without proper disclosures. Their goal? Squeeze money out of business owners who didn't know the rules. (Yes, that's actually a thing.)
Running ads on Meta? You can't do it without an active privacy policy. Want to send SMS marketing messages? Same deal — you need that policy in place before you can even get your number approved.
Wait, What Even ARE Cookies?
Great question. (Brooke asked too.) Cookies are essentially small signals — little bits of information — that tell websites and tracking tools where you came from, what you are doing, and where else you have been on the internet.
That's why you can search for compression socks on one site and suddenly see compression sock ads everywhere you go online. Third-party cookies track you across multiple sites and build a profile of your browsing behavior.
Here's the important part: compliant websites are required to disclose that they're using cookies and give you the option to opt out. That's what those pop-up banners are for.
One thing Cari flagged that most people don't know: if you just click the little X to close the cookie consent pop-up without making a selection, on most websites, you've just agreed to all the cookies. That X typically defaults to "accept," not "decline."
You also have more control than you probably think. Apple devices have a setting that lets you blanket opt out of cookies across all sites. Just know: you'll still see the consent pop-up when you land on websites (they're legally required to show it), and if you actively click "I agree" on a specific site, that overrides your phone setting for that site.
So What Do You Actually Do About This?
The good news: you don't have to pay a lawyer 00 an hour to handle this. There are tools built specifically for this problem. Brooke and Cari both use and recommend Termageddon, a policy generator that:
Walks you through a plain-English questionnaire about your site and what it does
Generates your privacy policy, cookie policy, disclaimer, and terms & conditions
Automatically updates your policies as state and federal laws change
Runs about $200/year
There are other similar tools out there (search "privacy policy generator" or "cookie policy generator"), but what makes Termageddon stand out is that it stays current as laws evolve — and privacy laws are changing constantly across all 50 states, DC, and internationally (yes, the EU and Canada have their own requirements too).
The questionnaire is thorough — but that's actually the point. Going through it forces you to think through what data you're collecting, where it's going, and what you're actually doing with it. As a business owner, you should know those answers.
The Bottom Line
If you have a website, you have legal obligations — whether you knew about them or not.
"I didn't know" won't hold up. Neither will copying a privacy policy from another website (which means it likely describes their data practices, not yours). Neither will having a policy that says one thing while your website does something completely different.
The legal fine print exists for a reason. It protects your visitors. It protects your business. And in a world where the rules change constantly, having a system that keeps it up to date isn't just smart — it's necessary.
You owe it to the people who trust you with their information. And the good news is, it's never been easier or more affordable to get it right.
Connect with Cari Kaufman
Cari Kaufman is a fractional Chief Storytelling Officer and Certified Data Privacy Partner at Storyteller Wordsmith. She helps solopreneurs and small businesses build brands that are as legally solid as they are memorable.
Website: storytellerwordsmith.com
Free 30-Minute Brand Game Plan Call: Book your spot here
Whether you need a full website audit, compliant policy pages, or help making your brand story magnetic — Cari and her team have you covered.
Listen to the Full Episode
Brooke and Cari go deeper on all of this — including the difference between cookies and PII, why the algorithm rabbit hole is a real problem, and what happened when Brooke went through the Termageddon questionnaire herself.
Watch on YouTube:
https://youtu.be/Zl-IIif_Jy0?si=O_tMbFqm45skzKb0
Or subscribe and listen wherever you get your podcasts. If this episode made you think, 'Oh crap — I need to check my website,' do it this week. Then leave us a review and share this episode with every business owner you know who has a website. (So, basically, all of them.)
The views and opinions expressed on Life Is Legal are those of Brooke Hardie and her guests alone, and are provided for informational and entertainment purposes only. Nothing in this podcast or any related materials is intended to be a substitute for professional legal advice.
