Privacy policies are complex documents that require a lot of unique details specific to each individual business, website, or mobile app.
But, sometimes, businesses accidentally leave out vital details, forget an essential clause, rely on imperfect workarounds, or make other mistakes that could lead to issues with privacy laws.
Below, I’ve outlined nine common privacy policy issues and give you tips about how to avoid making them.
- Spending Too Little Time Preparing
- Never Updating Your Privacy Policy
- Misstating Your Data Processing Activities
- Misunderstanding What Laws Apply to Your Business
- Using Complicated Language
- Not Reviewing Carefully
- Not Getting Clear Consent From Users
- Misplacing It on Your Site or App
- Using a Non-Reputable Generator or Template
- Summary
Spending Too Little Time Preparing
When making a privacy policy, try not to rush through the drafting and preparation phase.
Don’t get me wrong, I understand why business owners sometimes do this — we all want the process of creating necessary legal documents to be quick, easy, and painless.
But if you don’t spend enough time researching and drafting your privacy policy upfront, it will cause problems that may come back to haunt you later on. That pain could manifest as massive legal fines and negative backlash from your consumers.
Even if you plan on using a lawyer or a comprehensive managed solution, like our Privacy Policy Generator, there are still several things that you, as the business owner, need to prepare.
Specifically, you must determine:
- What data privacy laws apply to your business?
- What personal data does your website, app, or platform collect from users?
- Why do you collect the data, and how do you use it?
- How will you store the data to keep it safe and secure?
- Do you share the data with any third parties (and do they follow the same privacy guidelines as your business)?
Once you know your answers to these questions, it becomes easier to use a privacy policy generator, talk to a lawyer, or even write your own privacy policy.
Never Updating Your Privacy Policy
Another privacy policy issue you must avoid is neglecting to update or change it after posting it on your website or app.
Privacy policies are living documents that must accurately reflect your current data collection and processing activities. Otherwise, it directly violates data privacy laws, and you risk falling behind as more laws take effect.
The California Consumer Privacy Act (CCPA) requires businesses to update their privacy policy at least once every twelve months.
Other laws, including the General Data Protection Regulation (GDPR), hold you financially accountable if your policy details are inaccurate or inconsistent with reality.
When we asked data privacy attorney Anthony E. Saurini, Esq, CIPP/U.S., about the biggest mistakes businesses should avoid when making a privacy policy, he brought up the importance of building a policy that can adapt to the future.
According to Saurini, “The biggest mistake business owners should avoid when creating a global privacy policy is failing to fully anticipate their future regulatory needs.”
“Regulatory agencies in all regions of the world have begun to treat an individual’s personal data as an asset owned by that individual. In the United States alone, a multitude of individual states have recently passed data privacy legislation”
He adds, “Business leaders are already adapting to this new era of data minimization and privacy by design as it unfolds worldwide by investing in their future data privacy compliance needs today.”
Taking time today to establish a process for updating your privacy policy can help your business keep up with the fast pace of data privacy legislation.
Misstating Your Data Processing Activities
When you make a privacy policy for your business, avoid misstating or being dishonest about your data processing activities. In my opinion, this is one of the worst mistakes you could make.
When we spoke with data privacy expert and attorney Nadine Talaat CIPP/U.S., CIPP/E about the top mistakes business owners should avoid when making their privacy policies, she agreed, and immediately mentioned misstating privacy practices.
Talaat says, “The top mistake business owners should be mindful to avoid when they create a privacy policy for their website or app is aligning their privacy program to their privacy policy and articulating what data is being collected.”
Talaat adds, “The privacy policy must coincide with the business’ privacy program. This important step allow for both business compliance and the user’s privacy rights. There must be an understanding of what data is being collected, processed, and a clear purpose.”
Regulators and enforcement agencies look for incongruence between a company’s actions and what its privacy policy says, especially if consumers submit complaints.
An example of this happened in 2021 to Meta when Ireland’s Data Protection Commission fined WhatsApp €225 million ($247 million) for using an unclear, non-transparent privacy policy regarding its use of user data, which isn’t even the largest GDPR fine ever issued.
“Business owners should be transparent on what personal data they are collecting, including what data third parties are collecting through their website or app. “To do so, they need awareness of the applicable privacy regulations in their geographic market, whether this is within the United States or worldwide,” says Talaat.
She adds, “Although, the United States does not have an overarching federal data privacy regulation, there are regulations in place for several states including California’s CPRA and Virginia’s VCDPA.”
“Understanding the applicable regulations and implementing them correctly will build trust from the user. Overall, business owners should be knowledgeable and implement appropriate safeguards for privacy compliance measures.”
Building consumer trust is essential for businesses operating online today — just look at these alarming data privacy statistics:
- 1 in 5 users always or often reads a company’s privacy policy before agreeing to it. (Pew Research Center)
- 48% of users have stopped buying from a company over privacy concerns. (Tableau)
- 33% of users have terminated relationships with companies over data. (Cisco)
Ensure your privacy policy accurately reflects how you collect and use personal data, and avoid modeling it after a competitor or copying and pasting it from another website. Otherwise, you might end up literally paying for your mistakes.
Misunderstanding What Laws Apply to Your Business
It’s essential that you don’t misunderstand what data privacy laws apply to your business and impact your privacy policy. You are wholly liable for abiding by those regulations.
Most data privacy laws have broad scopes and affect businesses outside the regions where the legislation is in force. In other words, companies not located in Europe still fall under the GDPR, just like entities outside of California can fall under the jurisdiction of the CCPA.
When determining the data protection legislation that affects your company, it may also help if you answer the following questions:
- What jurisdiction are you in?
- Where are your customers located?
- What industry or industries are you in?
- Are there any industry-specific laws you must comply with?
Below, I included the legal threshold for 12 of the most significant data privacy laws worldwide and details about the penalties for violating those laws.
Read through these carefully and take note of the ones that apply to you.
| Data Privacy Law | Legal Threshold | Penalties for Violating the Law |
| General Data Protection Regulation (GDPR) | Any organization that collects, processes, or stores the personal data of individuals located in the European Union (EU) or European Economic Area (EEA). |
|
| The Data Protection Act (UK GDPR) | Any organization offering goods or services to UK citizens that processes their personal data. |
|
| Amended California Consumer Privacy Rights Act (CCPA/CPRA) | For-profit entities that do business in California and meet one of the following:
|
|
| California Online Privacy Protection Act (CalOPPA) | Any website with California visitors falls under the threshold of this law. |
|
| Virginia Consumer Data Privacy Act (VCDPA) | Entities doing business in Virginia or targeting Virginia residents who meet one of the following:
|
|
| Connecticut Data Protection Act (CTDPA) | Any data controller or processor who conducts business in Connecticut or produces products or services targeted at Connecticut consumers and any controller or processor who meets one or more of the following:
|
|
| Colorado Privacy Act (CPA) | Controllers that conduct business in Colorado or who produce or deliver commercial products intentionally targeted to Colorado residents that meet one (or both) of the following:
|
|
| Children’s Online Privacy Protection Act (COPPA) | Any website or online service that is directed to children under 13 that:
|
|
| Personal Information Protection and Electronic Documents Act (PIPEDA) | Any organization that collects and uses personal information in connection with commercial activities, including selling or sharing donors, membership, or fundraising lists, falls under PIPEDA. |
|
| Australia’s Privacy Act of 1988 | Any Australian government entities or organizations that have annual gross revenue of $3 million and small businesses that make less than $3 million who meet any of the following:
|
|
| New Zealand’s Privacy Act of 2020 | Any person, organization, or business in the public or private sector that collects and holds personal information about other people. |
|
| South Africa’s Protection of Personal Information Act (PoPIA) | Any entity registered to South Africa that processes personal data or people from any location.
And any entities located outside of the country who outsource their data processing to South Africa. |
|
Using Complicated Language
When it comes to the contents of your privacy policy, avoid using unnecessary jargon or legalese. These words and phrases commonly used by lawyers aren’t usually understandable or accessible to the average reader.
Some legislation, including the GDPR, states that entities with privacy policies not written in plain language violate the law. This requirement ensures transparency so everyone can read and understand what’s happening to their personal information and their rights over their data.
Similarly, you should avoid writing large text walls with convoluted run-on sentences.
Keep your audience in mind when making your privacy policy, and implement easy-to-read formatting techniques by taking advantage of tables, charts, graphics, and bullet lists.
Not Reviewing Carefully
Another common privacy policy issue you want to avoid is neglecting to carefully review your policy before publishing it, even if you use a reputable template or generator.
Remember in school when your teacher would remind you to check your work? Well, that logic works with your privacy policy, too.
Ensure you read through it and check for errors, inconsistencies, or anything you may have skipped or left out. You should also double-check it for grammar issues and verify its readability.
Not Getting Clear Consent From Users
Depending on what privacy laws you fall under, you may need to obtain explicit, affirmative opt-in consent from users before data collection occurs. This requirement is notably the case with the GDPR if consent is one of your legal basis for processing personal information.
If you find yourself in this situation, make sure you present all users who access your website or app with a live link to the most current version of your privacy policy and ask them to take some kind of action to denote that they’ve both read and agree to the terms you describe.
I typically recommend using a checkbox — just be sure it’s unmarked, as pre-ticked checkboxes are not GDPR-compliant.
Misplacing It on Your Site or App
Another common problem you want to avoid with your privacy policy is misplacing it on your website or app or forgetting to post it in necessary areas.
You should always plan to post your policy in more than one spot, but the precise locations depend on what laws your business falls under.
For example, under the CCPA, you must present your users with a notice at or before the point of collection. If you store personal information during the checkout process, you must provide a link to your policy on your checkout page.
Similarly, if you collect personal data from users when they create a login or new profile on your platform, you’ll also need to put a link to your privacy policy there.
Here’s a list of the most common places to include a link to your privacy policy:
- The footer of your website
- A static menu in your app
- Payment screens or checkout pages
- New user account creation pages
- In your marketing emails
- Content submission forms — if you allow users to post their creations
- On any forms that collect personal information from users
Using a Non-Reputable Generator or Template
There are so many excellent privacy compliance resources on the internet that can help you make a privacy policy for your business. But that means there’s also an equal amount of not-so-great options out there that claim to be compliant but, in reality, aren’t.
So be extra cautious when you download a free privacy policy template or try out a policy generator, and look out for these red flags:
- 🚩 They don’t actually ask about the specific data you collect: This is a red flag because each business collects different information for different reasons. If they don’t ask you for these details, then there’s no way the privacy policy will accurately reflect what information you’re processing.
- 🚩 There are no questions about where your users are from: Knowing where your users are located helps determine if your business falls under certain data privacy laws. If a generator isn’t asking you for this information, they’ll likely miss necessary laws you may need to follow.
- 🚩 You can’t review the policy before paying for it: If someone tries to make you pay before you get to review your generated privacy policy, this is a major red flag. You don’t want to spend upwards of $200 without getting to review and approve the policy first. I highly suggest avoiding websites that force this upon you.
- 🚩 There aren’t many questions for you to answer: If a generator or template feels very short, it may be because it’s missing essential clauses and elements necessary for achieving full legal compliance. Be wary of any super short policies, as they’re likely incomplete.
- 🚩 They don’t ask about your use of internet cookies: Internet cookies qualify as personal information, and many data privacy laws require you to allow users to opt out of things like targeted advertising, often done by placing internet cookies on your users’ browsers. If a template or generator doesn’t have anything about cookies in it, then it’s probably incomplete.
Summary
By avoiding the nine common privacy policy issues I covered in this guide, you’re setting your website or app up for successful and painless data privacy compliance.
You’re also showing consumers they can trust you with their personal information.
It’s worth putting in the extra effort to avoid those hefty fines and public backlash in the future.
You can make it extra easy on your business by using Termly’s Privacy Policy Generator to customize an agreement that perfectly suits your privacy compliance needs.
DISCLAIMER: All information, content, materials, and quotes presented in this article are for general informational purposes only and do not, and are not intended to, constitute legal advice. Information on this page may not constitute the most up-to-date legal or other information.
More about the author
Written by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Masha is an Information Security and Data Privacy Specialist and a Certified Data Protection Officer. She has been a Data Protection Officer for the past six years, helping small and medium-sized enterprises achieve legal compliance. She has also been a privacy compliance mentor to many international business accelerators. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD). Masha studied Law at Belgrade University, and she passed the Bar examination in 2016. More about the author
