Privacy Policy Generator
Answer a few questions about what your website or app collects and get a complete, plain-English privacy policy with the sections US laws and Google AdSense expect. Copy it as formatted text, HTML or Markdown. Everything is generated in your browser.
Last updated:
This template is a starting point, not legal advice. Review it, remove anything that does not match what you actually do, and ask a lawyer if you handle sensitive data.
How to use the Privacy Policy Generator
- Describe your site or app: name, URL, owner, home state, contact email and effective date.
- Tick the personal information you collect, such as email addresses, accounts, payments or device data.
- Choose your cookies, analytics and ad setup, for example Google Analytics and Google AdSense.
- Switch on the law sections you need: US state privacy rights, CalOPPA, COPPA and optionally GDPR.
- Review the live preview, fix any warnings, then copy the policy or download it as HTML, Markdown or text and link to it from your site footer.
Which privacy law sections do you need?
US privacy law is a patchwork: there is no single federal privacy law for websites, so the sections your policy needs depend on who visits, what you collect and how you make money. Use this table as a quick guide to the switches in the generator.
| Law or rule | Who it applies to | What the policy must say |
|---|---|---|
| CalOPPA (California, 2004) | Any commercial website or app that collects personally identifiable information from California residents, wherever the business is based | Categories of data and third parties, how users review changes, how you announce updates, effective date, Do Not Track response, cross-site tracking by third parties |
| CCPA / CPRA (California) | For-profit businesses over the revenue or data-volume thresholds | Categories collected in the last 12 months, rights to know, delete, correct and opt out of sale or sharing, how to submit requests, non-discrimination |
| Other state laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and more) | Businesses over each state's thresholds (Texas has no revenue threshold for most businesses) | Similar consumer rights, opt-out of targeted advertising and sale, and an appeal process for denied requests |
| COPPA (federal) | Sites and apps directed to children under 13, or with actual knowledge of collecting their data | What is collected from children, parental consent, parents' right to review and delete, contact details of the operator |
| CAN-SPAM (federal) | Anyone sending commercial email | Not a policy requirement, but every marketing email needs a working unsubscribe link, which the policy mentions |
| Google AdSense / Analytics terms | Sites using those Google services | Use of cookies by Google and third-party vendors, opt-out links (Ads Settings, aboutads.info, Analytics opt-out add-on) |
| GDPR / UK GDPR | Sites that target or monitor people in the EU, EEA or UK | Controller identity, legal bases, data subject rights, international transfers, right to complain |
Checklist before you publish
- Match reality. Only keep a data type or service in the policy if you really collect or use it. A policy that promises more than you do, or hides a tracker, is the main thing regulators act on.
- List every third-party script. Analytics, ad networks, embedded videos, chat widgets, comment systems and social buttons can all set cookies. Check your page in the browser's developer tools (Application > Cookies) to see what is really there.
- Pair it with a cookie banner if you have visitors from the EU or UK, or if you need an opt-out of targeted ads for US state laws.
- Link it everywhere it matters: the site footer, sign-up and checkout forms, your app store listing and inside the app's settings screen.
- Review it at least once a year, and whenever you add a new tool, form or ad partner. Update the effective date each time.
- Answer requests on time. Under the CCPA you must respond to verified requests within 45 days, and most other states use the same window.
Frequently asked questions
Does my website need a privacy policy?
If your site or app collects any personal information from US residents, including email addresses, IP addresses through analytics or cookies through ads, the California Online Privacy Protection Act (CalOPPA) requires a conspicuously posted privacy policy, and services such as Google AdSense, Google Analytics, the Apple App Store and Google Play also require one. In practice almost every website needs one.
What must a privacy policy include under CalOPPA?
CalOPPA requires you to list the categories of personally identifiable information you collect and the categories of third parties you share it with, explain how users can review or change their information if you offer that, describe how you notify users of changes, state the effective date, and disclose how you respond to Do Not Track signals and whether third parties can track users across sites.
What does Google AdSense require in a privacy policy?
Google requires publishers to disclose that third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to your site or other sites, and to tell users they can opt out of personalized advertising through Google's Ads Settings or aboutads.info. The generator adds this wording when you choose Google AdSense.
Do I need CCPA language if I am a small site?
The CCPA applies to for-profit businesses that do business in California and meet a threshold: more than about $25 million in annual revenue (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or earning at least half of revenue from selling or sharing personal information. Other states have their own thresholds. Many small sites include the rights section anyway because it is good practice and costs nothing.
What is COPPA and when does it apply?
The Children's Online Privacy Protection Act is a US federal law that applies to websites and apps directed to children under 13, or that knowingly collect personal information from them. Such services must post a clear policy, get verifiable parental consent before collecting a child's information and let parents review and delete it. If your site is for a general audience, choose Not directed to children and say you do not knowingly collect children's data.
Is a generated privacy policy legally binding?
A privacy policy is a public statement of your practices, and regulators such as the FTC and state attorneys general can act if it is false or misleading. That is why it must match what you really do. Use this generator as a solid starting draft, remove anything that does not apply, and get legal advice if you handle sensitive, health, financial or children's data.
Where should I put my privacy policy?
Publish it on its own page, for example /privacy-policy, and link to it from the footer of every page, from sign-up and checkout forms, and from your app store listing. CalOPPA requires the link to be conspicuous, for example a link with the word Privacy on your home page.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.