In the United States, there is no single federal law that requires a company to have a privacy policy. Some laws mandate it under certain circumstances, including the following:

  • The Children’s Online Privacy Protection Act (COPPA) requires commercial websites and online services (including mobile apps) that knowingly collect information about, or target children under age 13, to post a clear and comprehensive online privacy policy;
  • The Gramm-Leach-Bliley Act requires institutions “significantly engaged” in financial activities to give “clear, conspicuous, and accurate statements” of their information-sharing practices;
  • The Health Insurance Portability and Accountability Act (HIPAA) requires companies engaged in health care services to give written notice of its privacy practices; and
  • California law (Calif. Bus. & Prof. Code §§ 22575-22578) requires an operator of a commercial website or online service (including mobile apps) that collects personally identifiable information (PII) about California residents to post a Privacy Policy on its website.

Even if a privacy policy is not required by law, the Federal Trade Commission (FTC), the nation’s chief privacy and data security enforcement agency, encourages businesses to give consumers written notice of the company’s privacy practices when collecting and using PII, including how the company collects, uses and discloses PII. In recent years, the FTC has increasingly brought actions against companies that failed to follow their own stated privacy policies as an unfair and deceptive trade practice. Thus, it is crucial to draft a privacy policy carefully; poor drafting can create traps for the unwary and open a company up to liability.