Does My Small Business Website Need a Privacy Policy?

Yes, your site needs a privacy policy, and that's true whether you sell one product to five states or run a single-location shop. No, US law doesn't require the EU-style pop-up that makes a visitor click Accept or Reject before the page loads.

And yes, in 12 states, your site has to honor a background signal called Global Privacy Control, which the visitor never sees at all. The tools you already run are the reason a policy comes first, before any state law even enters the picture.

Does My Small Business Website Actually Need a Privacy Policy?

Yes, for two independent reasons, and either one alone is enough. The first is contractual: Google Analytics, Stripe, and Meta's advertising tools all require you to post a privacy policy as a condition of using their services, regardless of where your business is located or how many employees you have.

The second is legal: a handful of states, led by California, require any site collecting visitor data to post one, with zero exemption for small size.

Most owners assume this is a "big company" problem. It isn't. Neither the vendor contracts nor CalOPPA care how many people you employ. What follows breaks down both reasons in order, starting with the one that hits first: the terms of service you already agreed to when you installed Google Analytics or connected Stripe.

Why Your Own Tools Require a Privacy Policy Before Any Law Does

If your site runs Google Analytics, takes payments through Stripe, or runs a Meta ad pixel, you already agreed to post a privacy policy the day you turned them on. This obligation exists inside the vendor's terms of service, not a government statute, so it applies the moment you install the tool, not once your business crosses some size threshold.

Google's Analytics Terms of Service are the clearest example, and worth quoting directly: "You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies, identifiers for mobile devices... or similar technology used to collect data" (Google Analytics Terms of Service, Section 7). The same section also requires you to disclose your use of Google Analytics itself, typically by linking to Google's own explanation of how it uses site and app data.

Stripe's Data Processing Agreement puts the same obligation in plainer language, in a section titled "Disclosures": "User must provide all necessary notices (including by making available a Privacy Policy) to, and obtain all necessary rights, permissions and consents from, Data Subjects... to enable Stripe to lawfully Process any Personal Data provided by User" (Stripe Data Processing Agreement, Section 4.3). Stripe also shifts the burden onto you, the merchant, stating plainly that "User is solely responsible for the content of notices it provides to its Customers." Meta's Business Tools Terms carry a comparable duty: a business using Meta's Pixel or Conversions API has to obtain the necessary consent before sharing visitor data with Meta and give visitors a plain-language explanation of what data it collects, who it's shared with, and how visitors can control that sharing (Meta, "Privacy and data use requirements for Meta Business Tools").

None of that is state legislation. It's the fine print you accepted to use tools you probably didn't think twice about installing. The practical consequence of skipping it isn't a lawsuit, it's a vendor account suspension, which for a business running payments through Stripe or ad tracking through Meta is its own kind of emergency.

Do I Need a Cookie Consent Banner on a US Website?

No. No US law requires the EU-style "Accept All / Reject All" pop-up that blocks the page until a visitor makes a choice. That pattern exists because of GDPR and the UK's PECR, both European frameworks with no US equivalent.

What US law actually requires, in a growing list of states, is a background signal-honoring duty called Global Privacy Control, and it's invisible to the person browsing your site.

This is probably the single most misunderstood part of the whole topic, and it's not an accident. Nearly every vendor selling consent-banner software has a financial reason to make US businesses believe the EU pop-up is a legal requirement here. It isn't, and installing one you don't need adds friction to your site for no compliance benefit.

What Are the Two Different Kinds of "Cookie Banner," and Which One Do I Actually Need?

The confusion comes from two genuinely different mechanisms that share the same nickname: the EU/UK-style opt-in pop-up and Global Privacy Control (GPC). Only one applies to a US-facing small business site: GPC, the background signal, not the blocking pop-up built for GDPR and PECR.

The EU/UK-style opt-in banner is the pop-up built for GDPR and PECR: it blocks the page, forces a binary choice, and logs consent before any cookie fires. It has no US legal basis for a site that isn't targeting EU or UK visitors, and bolting one onto a US small-business site is solving a problem you don't have.

Global Privacy Control (GPC), by contrast, is a signal your site has to detect and respect, not a banner you show. It travels as a browser header (Sec-GPC) or a JavaScript property (navigator.globalPrivacyControl), sent automatically by privacy-focused browsers and extensions like Brave, DuckDuckGo's browser, and Privacy Badger, before the visitor interacts with the page at all (Clym, "What Is Global Privacy Control?"). Honoring it means your site automatically treats that visitor as opted out of having their data sold or shared, typically paired with a visible but non-blocking "Cookie settings" or "Your privacy choices" link for anyone who wants manual control.

Twelve states now require honoring GPC: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas (Clym). And this obligation is being actively checked. In September 2025, California, Colorado, and Connecticut announced a joint enforcement sweep specifically targeting businesses that weren't processing GPC opt-out signals, using automated scanning rather than waiting on a consumer complaint (California Privacy Protection Agency). "Nobody has complained about us" isn't a safe read on your exposure when the check itself doesn't require a complaint to trigger.

Which States Have a Privacy Law With No Small-Business Size Threshold?

Three states apply no small-business exemption at all to the basic notice requirement. CalOPPA (California's Online Privacy Protection Act) applies to any operator of a website or online service that collects personal information from California residents, full stop, with no revenue or visitor-count floor written into the applicability language (California Business and Professions Code Sections 22575-22579).

Delaware's DOPPA works the same way for Delaware residents, requiring a conspicuously posted privacy policy from any operator collecting personal data through the internet, with the same zero-employee-count floor (Delaware Code, Title 6, Chapter 12C).

Nevada is the one that trips people up, because its statute looks like it has a small-business exemption until you read the fine print. NRS 603A.340's exemption only applies if a business meets all three of the following at once: fewer than 20,000 unique annual visitors, revenue derived primarily from a source other than online sales, and the business itself is located in Nevada (Nevada Revised Statutes 603A.340). Miss any single one of those three conditions, not all three, and the exemption doesn't apply. A Nevada-based shop with 25,000 annual site visitors is covered by the notice duty even though it's a genuinely small business.

Beyond those three zero-threshold states, 20 states now have a comprehensive consumer privacy law in effect as of January 1, 2026 (Multistate, "All of the Comprehensive Privacy Laws That Take Effect in 2026"). Most of those use a numeric consumer-count exemption, but two use a different test entirely: Texas and Nebraska exempt only businesses that qualify as a "small business" under the federal Small Business Administration's own size standards (Texas Business & Commerce Code Chapter 541), which vary by industry and can require up to several hundred employees or tens of millions in annual receipts depending on the sector, not a flat visitor count. Connecticut has tightened further: its exemption threshold dropped from 100,000 to 35,000 Connecticut residents on July 1, 2026, and it added a zero-floor trigger for any business that sells personal data at all, regardless of volume (Wiley Rein, "Major Changes to Connecticut's Consumer Privacy Law"). "We're too small to worry about this" is not a safe assumption for a business with customers in Texas, Nebraska, or Connecticut.

Has Any Small Business Actually Been Fined Over This?

Not yet, based on the public enforcement record. Every confirmed CCPA and CPPA settlement to date, including Sephora, Honda, Todd Snyder, Tractor Supply, and Healthline, has landed on a national or multi-location company, not a local service business with a handful of employees. The chart below shows how large those settlements ran.

CCPA / CPPA Enforcement Settlements, 2022-2025

Source: California DOJ and California Privacy Protection Agency official announcements

Healthline (2025)

$1.55M

Tractor Supply (2025)

$1.35M

Sephora (2022)

$1.2M

Honda (2025)

$632.5K

Todd Snyder (2025)

$345.2K

The gap between Todd Snyder's $345K and Healthline's $1.55M tracks company size and data volume, not any small-business carve-out written into the law.

That's a real pattern, but it isn't a guarantee, and the timing matters here. The CA/CO/CT sweep described above is automated and complaint-free, which means "small and unnoticed" describes today's enforcement record, not tomorrow's. Sephora, Healthline, and Tractor Supply were each cited in part for failing to honor GPC opt-out signals specifically, the same mechanism a small site can get right or wrong without ever intending to.

What Exactly Does My Privacy Policy Need to Say?

At minimum, your privacy policy needs to name every vendor that touches visitor data on your site, and say plainly what each one collects. That typically means Google Analytics, Stripe or another payment processor, Meta's ad tools if you run them, and whatever email or CRM tool captures your contact form submissions.

It needs to disclose your use of cookies, reference a working opt-out or GPC-honoring mechanism, and it needs to actually get updated when you add or drop a tool, not sit untouched for three years while your tech stack changes underneath it.

If you want the full breakdown by tool, our free Privacy Policy Vendor Checklist below walks through exactly what each common small-business tool requires you to disclose. You can also see our own privacy policy as a working example of what this looks like assembled into one page.

How Untap Web Builds This Into Every Site We Launch

Every site we launch treats consent as infrastructure, not an afterthought bolted on before a client review. Google Analytics doesn't fire until a visitor opts into the analytics category, Google's Consent Mode v2 signals are wired up correctly, and the site detects the GPC browser signal automatically rather than relying on a visitor to find a settings page.

A persistent "Cookie settings" control lives in the footer on every page, so the manual opt-out path is always one click away even when the automated GPC signal isn't present.

This is baseline in both the $249/mo Stand Up plan and the $649/mo Growth plan, not an upsell. If you're deciding which plan fits your business, compare the Stand Up and Growth plans side by side.

Coverage varies by state in ways that matter here. Minnesota is one of the 12 GPC states, so a Minnesota business site, and we work with Minnesota businesses across a range of industries, has to honor the signal regardless of company size. Illinois isn't on that list yet, so Illinois service businesses don't face the same GPC duty today, though CalOPPA can still reach an Illinois-based site the moment it has a single California customer submitting a form.

The three-part answer is simple even though the details aren't: post a real privacy policy because your vendors and several states already require it, skip the EU-style pop-up because no US law asks for one, and make sure your site actually honors GPC if you're in one of the 12 states that requires it. For the rest of what a compliant site needs beyond privacy and cookies, we're publishing a full small business website compliance checklist in December 2026. Grab the Privacy Policy Vendor Checklist to work through your own tool stack, or talk to us about our web design process if you'd rather have this built in from the start. If you're curious what the actual lawsuit exposure looks like beyond a missing policy, our deeper look at wiretap-statute lawsuit risk covers that separately, and the TCPA guide for lead-form consent picks up the next compliance gate most small-business sites miss. Website accessibility is another compliance gate worth checking while you're at it.

This is general information, not legal advice.