This free privacy policy template is ready to copy, paste, and adapt for your website today. It covers GDPR and CCPA. It downloads as a Google Doc, PDF, or Word file, with a plain-English guide to every blank. This is a starting template, not legal advice: have a lawyer review the finished version before you publish it.
Below: the full template, a section-by-section breakdown of what each clause discloses, step-by-step fill-in guidance, and the point where a static template stops being enough.
Copy the template below, replace every bracketed placeholder, and delete any section that does not apply to your site. The full text is copyable directly from this page, with Google Doc, PDF, and Word downloads further down.
``` Privacy Policy
Effective Date: [Insert Date] Last Updated: [Insert Date]
This Privacy Policy describes how [Website Name] ("we," "us," or "our") collects, uses, and shares your personal information when you visit [Website URL].
- Information We Collect
Information you provide: [name], [email address], [phone number], [billing/payment information], [account details]. Information collected automatically: [IP address], [browser type], [device data], [pages visited], [cookie and usage data].
- How We Use Your Information
We use your information to: [provide the service], [process transactions], [communicate with you], [send marketing communications, where permitted], [analyze site usage], [comply with legal obligations], [maintain security].
- Legal Bases for Processing (EU and UK Visitors)
Where the GDPR applies, we process your data under the following legal bases: [consent], [performance of a contract], [legitimate interests], [legal obligation].
- How We Share Your Information (Third Parties)
We share information with: [service providers], [analytics providers, e.g. Google Analytics], [payment processors, e.g. Stripe or PayPal], [advertising partners], [hosting providers], [legal or regulatory authorities, where required].
- Cookies and Tracking Technologies
We use cookies and similar technologies to [operate the site], [analyze traffic], and [personalize content]. For full details, see our Cookie Policy: [Cookie Policy URL].
- Data Retention
We retain your personal information for [time period], or as long as needed to [fulfill the purpose it was collected for], after which we [delete or anonymize it].
- How We Protect Your Information
We use [technical safeguard], [organizational safeguard], and [access-control measure] to protect your data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
- International Data Transfers
Your information may be transferred to and processed in [country/region]. Where required, we rely on [Standard Contractual Clauses] or another approved transfer mechanism to protect your data.
- Your Privacy Rights
Depending on your location, you may have the right to: [access your data], [correct inaccurate data], [request deletion], [request a copy in a portable format], [object to certain processing], [withdraw consent]. California and other US-state residents also have the right to opt out of the sale or sharing of personal information: [Do Not Sell or Share My Personal Information link]. To exercise any of these rights, contact us at [contact email].
- Children's Privacy
Our site is not directed to children under [13 / 16], and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [contact email].
- Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last Updated" date above.
- Contact Us
[Company legal name] [Contact email] [Postal address] [Data Protection Officer, if applicable] ```
The Privacy Policy Template (Copy, Paste, and Customize)
Copy the template above, then use the two variant notes and the format table below to adapt it to your regions and preferred file type. Every bracketed placeholder needs a real value before you publish; delete any clause that does not apply to your site.
GDPR Version (EU and UK Opt-In)
If your site has EU or UK visitors, keep Section 3 (Legal Bases for Processing). Use opt-in language throughout: visitors must take an affirmative action to consent before non-essential cookies or marketing communications start. Pair Section 9's rights list with the full GDPR set, including the right to lodge a complaint with a supervisory authority.
A US-only site with no EU or UK traffic can shorten or remove Section 3 entirely. Keep it if you have any EU or UK visitors. GDPR Article 13 requires you to disclose your legal basis for processing. Dropping that clause is the single most common GDPR gap in copy-paste templates.
CCPA / US State Law Version (Opt-Out)
If your visitors are mainly in California or other US states with privacy laws, frame Section 9 around opt-out rather than opt-in. Cookies and data collection can run by default, but you must give visitors a clear way to stop the sale or sharing of their data. Add the "Do Not Sell or Share My Personal Information" link required under the CCPA and CPRA.
The California Attorney General's guidance requires your notice at collection to list the categories of personal information you collect, and the purposes for each category. It must also cover six consumer rights:
- Right to Know
- Right to Delete
- Right to Correct
- Right to Opt-Out of sale or sharing
- Right to Limit Use of sensitive personal information
- Right to Non-Discrimination
Available Formats (Google Doc, PDF, Word, HTML)
Every format below contains the same 12-clause template. Pick whichever one matches how you edit documents day to day.
| Format | Access | Best for |
|---|---|---|
| On-page copy | Free, instant, no account | Pasting straight into your CMS or site footer |
| Google Doc | Make a copy and edit online | Teams that collaborate in Google Workspace |
| Word (.docx) | Download and edit offline | Editing in Microsoft Word before publishing |
| Download for reference | Printing or sharing a static reference copy | |
| HTML | Copy and paste | Embedding directly into a website template |
What's Inside This Privacy Policy Template
This template covers 12 required clauses plus a header block. It documents what data you collect, why you use it, your legal basis, and who you share it with. It also covers cookies, retention, security, transfers, rights, children's privacy, changes, and contact details. Missing any one of these is the most common reason a copy-paste policy fails a compliance check.
- Header (Effective Date and Last Updated): the two dates every reviewer checks first. A blank or stale date is the biggest red flag in a privacy policy, so update both fields every time you change the document.
- Information We Collect: every category of personal data your site actually gathers, split into what visitors provide directly and what your site collects automatically.
- How We Use Your Information: the specific purpose behind each category of data. GDPR's purpose-limitation principle means every purpose must map to data you actually collect.
- Legal Bases for Processing: the GDPR-required justification (consent, contract, legitimate interest, or legal obligation) for EU and UK visitors.
- How We Share Your Information: every third party or category of third party that touches visitor data, including analytics, payment processors, and ad networks.
- Cookies and Tracking Technologies: a short disclosure that points to your full Cookie Policy rather than duplicating it here.
- Data Retention: how long you keep each category of data and the trigger for deleting it.
- How We Protect Your Information: the security measures you use, plus an honest statement that no method is completely secure.
- International Data Transfers: required only if data crosses borders, for example an EU visitor's data processed on US servers.
- Your Privacy Rights: the GDPR rights menu (access, correct, delete, portability, object, withdraw consent) plus the CCPA opt-out and Do Not Sell or Share link for US visitors.
- Children's Privacy: a standard age statement, included even if your site does not target children.
- Changes to This Privacy Policy and Contact Us: how you will announce updates, plus a real, monitored contact channel, which the UK Information Commissioner's Office (ICO) lists as a mandatory element of any privacy notice.
Who This Template Is For
This template fits most small to mid-sized sites that collect standard personal data through forms, analytics, or checkout. It is not a substitute for legal review on a complex or high-risk site.
- Small businesses and marketing sites that collect contact-form submissions and run analytics.
- Bloggers and creators who use email signups, comment sections, or affiliate tracking.
- SaaS and app founders who collect account data, usage data, and payment information.
- Ecommerce stores that process orders, shipping addresses, and payment details.
- Agencies and freelancers building a starting privacy policy for multiple client sites.
This template does not fit a highly regulated site, such as one handling health or financial records under a statute like HIPAA. Those sites need a lawyer for sector-specific rules.
How to Fill In This Privacy Policy Template
Fill in the template in the order it appears. Inventory your real data practices first, complete each clause using that inventory, then check every bracket is replaced. Most fill-in mistakes come from skipping the inventory step and guessing at what the site actually does.
- Inventory your data and third parties first. Before touching the template, list every form field, analytics tool, payment processor, and login method your site uses (for example: a contact form, Google Analytics, Stripe, and Google sign-in). This inventory feeds Sections 1 and 4 directly.
- Common mistake: filling in Section 4 with generic categories like "analytics providers" instead of naming Google Analytics specifically. A generic template that never names your actual third parties, including something as common as Google sign-in, leaves out disclosures visitors and regulators expect to see.
- Complete Section 1 (Information We Collect) from your inventory. List only the data you actually collect. Delete any placeholder category, such as payment information, that does not apply to your site.
- Common mistake: leaving unused placeholder categories in the published policy. A policy that describes data you do not collect is inaccurate, not just incomplete.
- Complete Section 2 (How We Use Your Information) so every purpose matches a collected data category. If you list "targeted marketing" as a purpose, you need a data category and a legal basis that supports it.
- Choose your Section 3 framing based on your visitors. Keep the GDPR legal-basis language if you have EU or UK visitors; shorten it if you do not.
- Complete Section 4 (Third Parties) with one line per real service. Name each payment processor, analytics tool, and ad network individually.
- Common mistake: omitting a service like a chat widget or a social login integration because it feels minor. If it touches visitor data, it belongs in Section 4.
- Link your Cookie Policy in Section 5 instead of repeating a full cookie breakdown here.
- Set a real retention period in Section 6. "As long as necessary" without a timeframe or trigger is too vague for most regulators; give an actual duration or a clear deletion trigger.
- Fill in Sections 7 through 12 with your actual security practices, transfer safeguards, rights process, children's statement, update process, and contact details.
- Common mistake: listing a contact email that nobody monitors. GDPR Article 13 and the ICO both treat a working contact channel as mandatory, not optional.
- Set both header dates and re-check every bracket. Never publish a policy with an unfilled
[bracket]still visible; a stale or blank Effective Date is the fastest way to fail a review.
Copy the template above, or download it in your preferred format.
When You Need a Privacy Policy (and When a Template Is Not Enough)
You need a privacy policy the moment your site collects any personal data. A contact form, analytics, an account signup, a payment, or an ad network all count, which covers almost every website. This template handles that standard case well. It stops being enough once your data practices grow more complex or higher-risk than a static document can track.
- The template is enough when: your third-party list is short and stable, you serve one or two clear jurisdictions, and your data practices rarely change.
- The template is not enough when: you add and remove tracking scripts often, so the third-party disclosures go stale between reviews.
- The template is not enough when: you operate in multiple jurisdictions with materially different rights menus, such as GDPR opt-in alongside several different US state opt-out regimes.
- The template is not enough when: you operate in a regulated sector like health, finance, or children's services, where a specific statute layers additional requirements on top of GDPR or CCPA.
Community advice consistently treats a template as a starting point to adapt, not a document to copy verbatim from another site. Copying a competitor's policy describes their data practices, not yours, and it is copyrighted besides. For the full legal-requirement picture, see whether your website legally needs a privacy policy and what a privacy policy must include. For EU-specific depth, see GDPR privacy policy requirements. If you run an online store, see privacy policy requirements for an online store. Pair this document with a matching cookie policy template and see the legal pages every website needs for the full set.
FAQs
Is this privacy policy template free?
Yes. Copy or download it in any format with no account and no email required. An optional upgrade exists only if you want a generated, auto-current version built from your actual site.
Can I just copy and paste a privacy policy template?
Yes, as a starting point. You must replace every placeholder with your real information and delete any clause that does not apply to your site. A published policy that does not match your actual data practices is worse than having none at all.
Can I copy another website's privacy policy?
No, not verbatim. Another site's privacy policy is copyrighted and describes their data practices, not yours. Community advice consistently treats a free template as a base to adapt, not another company's finished policy to copy directly. See real privacy policy examples to study finished policies without copying one.
Can ChatGPT write my privacy policy?
It can draft the wording, but it cannot reliably determine which privacy laws apply to your site. It also cannot scan your trackers, so it can omit required clauses. A structured template or a generator that checks your actual site is a safer starting point.
What is the difference between a privacy policy template and a privacy policy generator?
A template is a static document you fill in by hand. A generator asks about your site and produces a tailored policy it can help you keep current as your practices change.
Do I need a privacy policy if I only use Google Analytics?
Yes. Google Analytics sets cookies and processes personal data, including IP addresses, which triggers the privacy policy requirement on its own. See whether your website legally needs a privacy policy, above, for the full requirement.
Can I use this privacy policy template on WordPress, Shopify, or Wix?
Yes. The template is platform-agnostic. Paste the text into a page on any of these platforms and link that page from your site footer.
How often do I need to update my privacy policy?
Update it whenever your data practices, tools, or the applicable law change, and re-date it every time. A stale Effective Date is one of the fastest ways a privacy policy fails a review.
Generate a Live Privacy Policy With Consently (When the Template Goes Stale)
A static template goes stale the moment your third-party list changes and nobody updates the document. Consently's Privacy Policy Generator builds your policy from a real scan of your site's cookies and trackers. It pairs that policy with a live consent banner, consent logs, and region-correct opt-in or opt-out framing, all of which a document alone cannot do.
- Section 4 (Third Parties) goes stale or incomplete. A static template cannot know which trackers your site runs today. Consently scans the site and keeps the disclosed third parties matching reality, so you regenerate the policy when your tracking stack changes instead of guessing.
- The header date and Section 11 (Changes) silently age. A copy-paste document ages quietly until someone remembers to check it. The generator lets you regenerate and re-date the policy on demand; it does not auto-update per visitor based on geolocation, so you still trigger the regeneration yourself.
- Section 9 (Rights) needs region-correct framing, and a document cannot enforce it. The generator produces the GDPR opt-in or CCPA opt-out framing automatically and pairs the policy with a live consent banner and consent logs, giving you enforcement a static file cannot provide on its own.
Consently's policy generators are compliance-assistance tools, not a replacement for legal advice, and generating a policy requires a domain connected to your Consently account.
Try Consently free to generate a privacy policy from your site's real cookie scan, or open the privacy policy generator directly.
