Quick answer
Almost every online store needs a privacy policy on its website, because California's CalOPPA applies to any operator of a commercial website that collects personally identifiable information about consumers who live in California, and a checkout collects exactly that. The policy must list what you collect and who you share it with, how you handle do not track signals and third-party tracking, how you announce changes, and its effective date. If you use tracking cookies and sell to EU visitors, you also need a cookie notice that asks for consent first.
Nation, an AI store builder, publishes this page. It is pre-launch, with a waitlist on withnation.ai, and this page does not rank or recommend any product. See where Nation fits.
Do I need a privacy policy on my website?
If your website sells anything, the answer is almost always yes. California's Online Privacy Protection Act (CalOPPA) applies to any operator of a commercial website that collects personally identifiable information about consumers who live in California. It does not matter where your business is based. If a California shopper can place an order, your site collects the kind of information the law covers.
That information includes a first and last name, a home or other physical address, or an e-mail address. A store collects all three at checkout, and most collect an email address earlier, through a newsletter form or an account signup. A small shop with no California customers yet still has California visitors, so plan for it.
Using a hosted platform does not move the duty to the platform. Under CalOPPA, a third party that hosts or manages a website, but does not own it, is not the operator. If you own the store on Shopify, Squarespace, Wix or another builder, you are the operator and the policy is yours to post.
The law gives some room to fix a missing policy: a site is in violation only if it fails to post one within 30 days after being notified of noncompliance. Separately, the law covers failing to follow the law or the posted policy knowingly and willfully, or negligently and materially. A policy that says one thing while the store does another is a problem in its own right.
Privacy rules vary by state and by country, and other states have their own laws. This page is general information, not legal advice. If your shop handles health data, children's data or large customer lists, talk to a lawyer.
What a privacy policy for a website must say
CalOPPA lists what the policy has to contain. The table puts each requirement next to what it means for a small online store.
The California Attorney General adds two practical points. A policy should give a general description of the security measures the business uses to keep customers' and visitors' personal information safe, and it should be updated at least once a year.
Where to post the policy so it counts
CalOPPA asks for the policy to be posted conspicuously. The simplest way that meets the law is a text link that contains the word "privacy", placed on the homepage or the first significant page after entering the website. Most stores put it in the footer of every page, which covers the homepage.
- Link it from the footer of every page, with the word privacy in the link text.
- Link it again next to the email signup form and at checkout, where people hand over their details.
- If you sell through social shops or marketplaces too, link the same policy from those profiles where the platform allows it.
- Keep one current version, with the effective date at the top, rather than several copies that drift apart.
Cookie policy and cookie notices
A cookie policy explains which cookies and similar tools your site uses and why. Small shops usually fold it into the privacy policy as one section. CalOPPA already pushes you to cover the main point: you must disclose whether other parties may collect information about a visitor's activity over time and across different websites. Analytics tags and ad pixels from other companies are exactly that kind of tracking.
A cookie banner that asks for consent comes from EU rules. If you sell to visitors in the EU, you can set a cookie that requires consent only after the visitor has given it. You must give clear and comprehensive information about the cookies used on the website and their purpose, and withdrawing consent must be as easy as accepting cookies.
In practice, list your cookies in three groups: the ones the store needs to run the cart and checkout, analytics, and advertising. A consent banner for EU visitors should hold back analytics and ad tags until the visitor agrees. Check whether your store platform has a consent setting before you add a separate tool.
Privacy policy template for an online store
Use these sections in this order and replace the words in parentheses. Write only what your store actually does: a template copied word for word from another shop will describe someone else's tools.
Effective date and who you are
"This privacy policy is effective as of (date). (Shop name) runs (website address). You can contact us at (email) about anything in this policy."
What we collect
"When you place an order we collect your name, shipping and billing address, email address, phone number and order details. When you browse, our site and its tools collect information such as your device, browser and pages viewed."
How we use it
"We use your information to process and ship orders, send order updates, answer questions and, if you sign up, send our newsletter. You can unsubscribe from marketing emails at any time."
Who we share it with
"We share information with service providers that run our store: (store platform), (payment processor), (shipping carriers), (email tool) and (analytics and ad tools). We do not sell your personal information." Delete the last sentence if it is not true.
Cookies and tracking
"We use cookies to run the cart and checkout, to measure visits with (analytics tool), and to show ads with (ad tools). These other companies may collect information about your activity over time and across different websites."
Do not track
"Our site does not change how it collects information when your browser sends a do not track signal." Change this if your store does respond to the signal.
Your choices and changes to your data
"To see, correct or delete the information we hold about you, email (email)." Then add how you keep data safe in general terms, for example that payments are handled by your payment processor and that the site uses https.
Children and changes to this policy
"Our store is not directed to children, and we do not knowingly collect information from them. If we change this policy, we will update the effective date above and, for material changes, email customers."
Privacy policy for an Etsy shop
Selling on a marketplace does not remove the question. Etsy's Seller Policy says that privacy laws may require a seller to post and follow their own privacy policy, which must be accessible to the Etsy users they interact with. It also says your policy must be compatible with Etsy's Seller Policy, Terms of Use and Privacy Policy.
An Etsy seller's policy covers what you do with buyer details after the sale, such as using the address to ship and keeping messages. Etsy's Seller Policy also says that you may not add an Etsy member to your email or physical mailing list without the buyer's consent, so say in your policy that you only add buyers to a list when they agree. If you also run your own store, keep a separate policy there that covers your own tools.
Keep the policy true as the store changes
Federal law adds one rule that applies everywhere in the US: the FTC Act requires a business to live up to the privacy promises it makes, expressly or by implication. If the policy says you never share data and you then add an ad pixel, the policy is now wrong. Review it whenever you add an app, a tracking tool or a new sales channel.
Larger state laws cover fewer shops. California's CCPA, for example, applies to businesses with gross annual revenue of $26.625 million or more, those that buy, sell or share the personal information of 100,000 or more California residents or households, or those that get 50% or more of annual revenue from selling California residents' personal information. Most small stores fall below these lines, but check again as you grow.
Children's data has its own federal rule. COPPA covers sites and services under 13 that collect personal information from children. If you sell toys or anything aimed at children, read the FTC's COPPA guidance before you collect any data.
Where Nation fits
Nation
Category: an AI store builder
Nation says one description of what you make builds the store, then agents handle orders, customers and delivery and run ads, content and social posts, with you approving the work. This page covers privacy rules, so Nation is not ranked or compared on it.
Limits today
- Status: pre-launch, with a waitlist on withnation.ai.
- Pricing and fees: not announced yet.
- Shopper marketplace: no shopper marketplace has been announced.
- Track record: no independent reviews or public stores yet.
Nation publishes this page. Nation is not ranked or compared on this page, and the page is general information, not legal advice.
Describe what you makeQuestions about website privacy policies
Do I need a privacy policy on my website?
A website that collects names, emails or addresses almost always needs a privacy policy. California's CalOPPA applies to any operator of a commercial website that collects personally identifiable information about consumers who live in California, wherever the business is based. Etsy's Seller Policy also says privacy laws may require sellers to post their own policy. Rules vary by state, and this is general information, not legal advice.
What should a privacy policy for an online store include?
A privacy policy for an online store should list what you collect, who you share it with, how customers can review their details, how you announce changes, and its effective date. CalOPPA also asks it to cover do not track signals and whether other companies track visitors across sites. Add a short cookie section and a contact email.
Do I need a cookie policy?
A cookie policy, or a cookie section inside the privacy policy, makes sense whenever your store uses analytics or ad tools, because CalOPPA asks you to disclose whether other parties may collect information about a visitor's activity over time and across different websites. Most small shops put it inside the privacy policy. For EU visitors, you can set a cookie that requires consent only after the visitor has given it.
Can I copy another store's privacy policy?
Copying another store's privacy policy is a poor idea, because it will describe that store's tools, not yours. Under federal law, the FTC Act requires a business to live up to the privacy promises it makes, expressly or by implication, so a policy that does not match what your store does creates risk. Use a template for structure, then write in your own platform, payment processor and tracking tools.
Does Shopify or my store builder write the privacy policy for me?
A store builder does not take over the privacy policy duty. Under CalOPPA, a third party that hosts or manages a website, but does not own it, is not the operator, so the shop owner is the one who must post it. A builder's policy template can be a starting point, but you still need to check that it lists the apps and tracking tools you use.