Eleven real, named companies run privacy policies worth studying: Google, Apple, Disney, Instagram, Slack, Uber, Strava, Airbnb, Outbrain, GOV.UK, and Medium. Each policy was checked live for this guide, not screenshotted from an old roundup.
Below, you get the exact elements that make each policy work. They are grouped by business type: Big Tech and consumer platforms, SaaS and apps, ecommerce and marketplaces, and plain-language public-sector models. A criteria framework comes first, then a weak-policy section, then three takeaways.
What Makes a Good Privacy Policy?
A good privacy policy is transparent about what data it collects and why. It is written in plain language, easy to navigate, generous with real user control, and visibly current. Weak policies usually fail the first two: they hide data practices behind vague phrasing, or bury them in legalese nobody reads.
The five criteria below are the lens for every example that follows. Each one names an observable signal, not just an abstract quality.
It is transparent about what data it collects and why
A transparent policy names the exact data categories it collects. It states why each category is collected, which third parties receive it, and how long it is kept. This is the floor, not a bonus. A complete policy discloses:
- The data controller's identity and contact details
- Categories of personal data collected (name, email, IP address, device identifiers, usage data, payment data)
- The purpose behind each category of collection
- The legal basis for processing (consent, contract, legal obligation, or legitimate interest)
- Third parties, processors, and subprocessors that receive data
- Data retention periods
- User rights (access, correction, deletion, portability, objection, withdrawal, complaint)
- International data transfer safeguards
- Security measures
- Cookies and tracking technologies
- Children's data handling
- An effective date
That list only summarizes the legal grounding. See what a privacy policy is for the fuller walkthrough of why each disclosure exists.
It is written in plain language, not legalese
Plain language means short sentences and everyday words. It favors concrete "if you do X, you see Y" examples over a wall of defined legal terms. GOV.UK's privacy notice, covered below, is the clearest live model. It states plainly what a data controller does. It ties every data use to a stated reason.
It is easy to navigate and easy to find
A navigable policy gives the reader a table of contents or a layered structure. It uses expandable sections for detail and a visible link in the site footer. A policy that is one unbroken scroll of text fails this test even when its content is accurate.
It gives users real control over their data
Real control means the policy names specific rights: access, delete, export, object. It links directly to the tool or process for exercising each one. Naming a right without a way to act on it is a disclosure, not control.
It is current, dated, and maintained
A visible effective date or last-updated date signals active maintenance. Version history is a bonus signal on top of that. A policy with no date anywhere on the page is a red flag: it suggests nobody has reviewed it since the underlying practices changed.
The 11 policies below were chosen because each shows at least one of these principles clearly. See what a GDPR-compliant policy must include for the full list of clauses regulators expect.
Big Tech and Consumer Privacy Policy Examples
The biggest consumer platforms collect the most data. Their policies show what full transparency and navigation look like at scale.
Google: a navigable structure paired with concrete data-use examples
Google's Privacy Policy organizes 10 sections behind a table of contents with anchor links. A reader can jump straight to "Information we collect" without scrolling past sections that do not apply to them. The policy also pairs abstract data-use statements with a concrete example. Search for a topic, and a related ad may follow you to another Google product. That single sentence does more explanatory work than a paragraph of generic disclosure language. The policy links directly to My Activity, Privacy Checkup, and My Ad Center, so the rights it describes are one click away, not just named. One gap: at this scale, the policy runs long. Its breadth across dozens of Google products makes it a heavier model than a single-site business needs to copy wholesale.
Apple: leading with rights and a specific no-sale commitment
Apple's Privacy Policy opens its rights section, "Your Privacy Rights at Apple," instead of burying it in later paragraphs. It lists the right to know, access, correct, transfer, restrict, and delete personal data. It backs that with a precise commitment.
Apple does not sell your personal data including as "sale" is defined in Nevada and California. Apple also does not "share" your personal data as that term is defined in California.
Naming exact statutory definitions, rather than a vague "we respect your privacy," is what makes the promise checkable. The lesson: lead with the reader's rights, then state your strongest commitment in terms a lawyer could not argue around. Worth noting: some sections stay formal beneath the friendly headings, so the plain-language commitment is not uniform throughout.
Disney: naming its tracking technologies and carving out a children's policy
The Walt Disney Company's Privacy Center names its tracking stack outright. Its "Online Tracking Technologies and Advertising" section names the technologies directly.
Cookies, Flash cookies, pixels, tags, software development kits, application program interfaces, and Web beacons.
Most sites bury this list or skip it entirely. Disney also runs a separate Children's Online Privacy Policy, a dedicated document rather than a buried paragraph, given how many Disney properties serve young audiences. The principle: if you track for advertising or serve children, disclose both in their own clearly labeled sections. Honest gap: the tracking disclosure reads technically rather than plainly, and no single effective date appears on the main privacy center page.
Instagram: plain-language highlights at consumer scale
Instagram's Privacy Policy (effective December 16, 2025) tackles a genuinely hard problem. It explains a massive, cross-product data operation without losing the reader. Each section carries a "Highlights" summary plus a simpler-language subsection. The policy also uses a real comparison to make an abstract point concrete.
We collect different information if you sell furniture on Marketplace than if you ask AI at Meta to write a joke for you.
It backs that with a direct commitment.
We don't sell any of your information to anyone, and we never will.
The principle: even a sprawling, multi-product operation can be made readable with a summary layer and a relatable example. Honest gap: it is one Meta-wide policy, so an Instagram-only reader still has to parse cross-product sharing that may not apply to them.
SaaS and App Privacy Policy Examples
Software and app policies hinge on two things a consumer policy can skip. One is the controller-versus-processor split. The other is a format that actually works on a small screen.
Slack: stating the controller and processor roles plainly
Slack's Privacy Policy (effective July 5, 2023) draws a hard line between two categories. "Customer Data" is the messages and files an organization submits. "Other Information" is the usage, account, and device data Slack itself collects. It then states outright:
Slack is a processor of Customer Data and the Customer is the controller.
A B2B tool runs two different data relationships at once. Burying that distinction leaves both the buyer and their end users unclear on who is accountable for what. The principle: when your product handles a customer's own data on their behalf, say explicitly who controls it and who only processes it. Honest gap: the 2023 effective date is the oldest of the SaaS examples here, and signals a refresh may be due.
Uber: a visible update date and a menu built for a huge, mixed audience
Uber's Privacy Notice for Riders and Order Recipients (last updated March 26, 2026) leads with a Roman-numeral table of contents. It states its own scope up front: this document excludes driver-side data, with a direct link to a separate notice for Drivers and Delivery People. It also links a "Download Your Data" tool and a previous version of the notice. Both current access and historical comparison sit one click away. The principle: when your audience is genuinely mixed, split the notices by audience instead of writing one document that tries to cover everyone. Honest gap: a person who is both a rider and a courier has to read two separate documents for the full picture.
Strava: scannable sections that still spell out sensitive data handling
Strava's Privacy Policy (effective January 1, 2026) runs about 12 bold, bulleted sections built for a mobile screen. That brevity does not skip the hard disclosures. It states directly:
For our core features to function (e.g., GPS activity tracking, routes, segments), you must grant us permission through your device to track your device's precise location.
On health data, it commits that it will not sell or use data like heart rate for advertising. It also promises not to disclose that data to third parties without prior consent. The principle: a mobile app can format for a small screen and still be explicit about its riskiest data, location and health. Honest gap: the defaults are disclosed, but a cautious user has to dig into the rights section to actually change them.
Ecommerce and Marketplace Privacy Policy Examples
Connecting two sides of a marketplace, or running on advertising, adds data a single-audience consumer policy never touches. Think of the other party's data, region-specific rules, and named advertising partners.
Airbnb: separating host and guest data, layered with regional supplements
Airbnb's Privacy Policy (last updated February 5, 2026) keeps host-specific data in its own sections. Business licenses, background screenings, and professional background stay separate from guest-specific data like travel insurance and booking information. The two sides of the marketplace have genuinely different data relationships with Airbnb. The core policy then links regional supplements: the United States, the EEA and other non-US regions, Brazil, China, and Korea. That beats cramming every jurisdiction's rules into one document. It also names its processors directly: Stripe, PayPal, and Klarna for payments, and HireRight for background screening. The principle: a two-sided marketplace operating across borders needs separated data stories by audience, plus regional layers. Honest gap: the core-plus-supplements design means an EEA user has to read two documents for the complete picture.
Outbrain: segmenting the policy by who is actually reading it
Outbrain's Privacy Policy splits its readers into three groups up front. Users on partner sites, business partners, and visitors to outbrain.com itself each get pointed toward the section that actually applies to them. It also makes an unusually direct disclosure for an adtech company.
We do not collect traditional Personal Data from you, like your email address or name.
It relies instead on cookie-based identifiers. The policy dedicates a section to children and sensitive data, and states that it honors the Global Privacy Control signal. The principle: when different readers have fundamentally different data relationships with you, segment the policy by reader. Honest gap: no single visible last-updated date appears on the page, and the adtech subject matter stays complex even after segmentation.
Plain-Language and Public-Sector Privacy Policy Examples
These two examples prove a privacy policy can be genuinely readable. That is the strongest lesson for a small site writing its first one.
GOV.UK: plain enough for any reading level to follow
GOV.UK's privacy notice (last updated June 1, 2025) defines its central legal role in one plain sentence.
A data controller determines how and why personal data is processed.
It ties every data use to a stated purpose instead of listing data in the abstract. IP addresses and browser details get collected to monitor for security threats. Analytics data gets collected to improve site search. The principle: plain, short sentences with a purpose attached to every data point are the readability standard other policies should measure against. Honest gap: as a government service, it does not model the marketing or ecommerce data uses a commercial site needs to disclose.
Medium: a clear structure for a mixed audience of readers and creators
Medium's Privacy Policy (effective March 24, 2022) organizes its disclosures behind a table of contents: Collection, Use, Sharing, Third-Party Embeds, Transfers, and Choices. It separates what a user provides directly from what gets collected automatically and from third-party sources. It also includes a reassuring, specific line.
We do not collect payment information through our Services. We rely on third parties to process payments in connection with our Services.
The principle: a clear structure plus a plain, specific reassurance beats a wall of undifferentiated text. Honest gap: the 2022 effective date reads as due for a refresh relative to the other examples here.
What a Weak Privacy Policy Looks Like
Weak policies share a small set of recurring failures. Each one maps directly to a criterion above.
- A policy copied verbatim from a larger company, so it describes their data practices and named partners, not the site's own. This violates transparency, and per multiple legal sources, it is copyright infringement, not just a bad look.
- Vague language such as "we may collect information to improve our services," with no data categories, purposes, or third parties named. This violates transparency at its most basic level.
- No effective date anywhere on the page, and no sign the policy has ever been updated. This violates the current-and-maintained criterion.
- Rights mentioned by name with no actual way to exercise them, or no rights section at all. This violates real user control.
How to Apply These Privacy Policy Principles to Your Own Site
Three actionable takeaways carry across all 11 examples above.
- Start from your own data practices. List exactly what you collect, why you collect it, and who you share it with, then disclose precisely that.
- Write it in plain language with a clear structure and a visible effective date, following the GOV.UK and Medium models above.
- Never copy a bigger company's policy. Generate or draft your own from your real practices, and keep it current as those practices change.
The hardest part is disclosing your own data practices accurately. That means the cookies actually running on your site, the third parties actually receiving data, and the rights you can actually honor. A copied template gets all three wrong, because it describes someone else's site. Consently's privacy policy generator builds your policy from a guided workflow around your own data practices, not a fill-in-the-blank template. It supports direct embedding, generates in 10 or more languages, and sits alongside Consently's cookie policy and terms and conditions generators. Generate your privacy policy free at Consently.
FAQs
What are good examples of a privacy policy?
Google and Apple show transparency and real user control at consumer scale. Slack shows controller-versus-processor clarity for a B2B tool, and GOV.UK shows plain language done right. All 11 examples above are grouped by business type: Big Tech and consumer, SaaS and app, ecommerce and marketplace, and plain-language public-sector.
What makes a good privacy policy?
A good privacy policy is transparent about what data it collects and why. It is written in plain language, easy to navigate and find, generous with real user control, and visibly current with a maintained effective date. Weak policies typically fail transparency or plain language first.
What should I write in my privacy policy?
A complete privacy policy names:
- What data you collect and why
- The legal basis for processing it
- Who you share it with
- How long you retain it
- The rights users can exercise
- Your use of cookies and tracking technologies
- Contact details and an effective date
Can I copy another website's privacy policy?
No. Privacy policies are copyrighted documents, and multiple legal sources confirm that copying one is copyright infringement, not just a risky shortcut. A copied policy also describes the other company's data practices and named partners, not yours. Use well-annotated examples like the ones above as a structural model, then write your own from your actual practices.
Can I use ChatGPT to write my privacy policy?
It can draft plausible-sounding language. It cannot determine which privacy laws apply to your specific business, because it cannot ask you clarifying questions about your data practices and jurisdiction. Raw AI output risks being incomplete or simply wrong. A guided generator that asks about your actual practices, or a lawyer, is the safer path.
Do I need a privacy policy for my website?
Almost certainly yes. Collecting any personal data triggers the requirement under GDPR, CCPA, and most app store rules. That includes a name, an email address, an IP address, or analytics and advertising data. Nearly every site collects at least one of these. A purely static brochure site with no forms, no analytics, and no tracking is the rare exception.
What is the difference between a privacy policy and a privacy notice?
The terms are largely interchangeable for a public-facing document. Some organizations use "notice" for a shorter public statement and reserve "policy" for a fuller internal document. There is no universal rule, so pick one term and use it consistently. See what a privacy notice is for the fuller distinction.
How do I create a privacy policy for my website?
To create a privacy policy:
- List the data you actually collect and why you collect it
- Scan your site for cookies and trackers so nothing goes undisclosed
- Draft or generate the policy from those real practices
- Add an effective date and review it whenever your data practices change
For the underlying data you will disclose, a website's legal pages work together as a set. If you run an online store, a privacy policy for an online store has extra categories to cover, like payment processors and shipping data. Start from a privacy policy template built for your situation, rather than a bigger company's policy. Pair it with a cookie policy template if your site uses tracking technologies.
