When’s the last time you updated your privacy policy?
Data privacy laws require you to publish an accurate, up-to-date privacy policy on your website, or you risk getting fined and facing public backlash.
Below, I teach you all about updating your privacy policy, answer common questions, and offer solutions to help you achieve legal compliance and build customer trust.
- Why Are So Many Privacy Policies Being Updated?
- Why Should I Update My Privacy Policy?
- How Often Should I Update My Privacy Policy?
- Why Do You Need to Inform Users About Privacy Policy Updates?
- How Can You Notify Users About Privacy Policy Updates?
- How to Update Your Privacy Policy
- Privacy Policy Updates FAQs
- Summary
Why Are So Many Privacy Policies Being Updated?
Companies keep updating their privacy policy year after year because, legally, they have to.
Privacy laws establish the standards for privacy policies, and nearly all of them require that these documents are accurate and kept up-to-date.
These are living documents that should change whenever your data collection practices do and be re-evaluated on a regular basis.
Why Should I Update My Privacy Policy?
I get this question a lot, and I recommend regularly updating your privacy policy at least once per year, but more often as needed.
Asking your customers to agree to an old, outdated document that no longer reflects your privacy practices violates privacy laws.
Updating your privacy policy also shows consumers that you’re transparent about the information you collect and take their data privacy seriously.
This is especially vital for businesses because data privacy statistics suggest that more and more people care what happens to their personal information online.
So anytime you change the functionality of your website or the way you interact with user data, I suggest you review your privacy policy and consider whether it still adequately addresses your data collection practices.
What Data Privacy Laws Require Privacy Policy Updates?
As I mentioned, you’re legally required to update your privacy policy so it remains accurate based on how you collect, process, and use personal information.
For example, the following data privacy laws directly or indirectly require you to update your privacy policy:
- General Data Protection Regulation (GDPR)
- UK GDPR
- ePrivacy Directive (EU Cookie Law)
- Amended California Consumer Privacy Act (CCPA)
- California Online Privacy Protection Act (CalOPPA)
- Virginia Consumer Data Protection Act (CDPA)
- Personal Information Protection and Electronic Documents Act (PIPEDA)
The table below explains how each law impacts privacy policy updates in greater detail — but I also included their legal thresholds and penalties, so you can learn more about their potential financial impact.
| Law | How it Impacts Privacy Policy Updates | Legal Threshold | Penalty for Violating the Law |
| GDPR | If you collect new information from users or want to use it in ways not already established in your privacy policy, you must make updates and re-obtain consent from users. | Any organization that collects, processes, or stores the personal data of individuals located in the European Union (EU) or European Economic Area (EEA). |
|
| UK GDPR | Like the EU GDPR, if you want to collect new pieces of data or use it in ways not already established in your privacy policy, you must update your agreement and re-obtain consent from users. | Any organization offering goods or services to UK citizens that processes their personal data. |
|
| EU Cookie Law | You must update your policy with new cookies or trackers your site uses, or else you could be fined for violating this law. | Any website with EU visitors that uses cookies or other tracking technology. |
|
| CCPA/CPRA | The amended CCPA explicitly states that you must update your policy at least once every 12 months. | For-profit entities that do business in California and meet one of the following:
|
|
| CalOPPA | You must include information about how you’ll update users about changes to your privacy policy. | Any website with California visitors falls under the threshold of this law. |
|
| Virginia CDPA | You must present your users with an accurate policy reflecting your current privacy practices, or else you risk getting fined for violating this law. | Entities doing business in Virginia or targeting Virginia residents who meet one of the following:
|
|
| PIPEDA | You must follow all ten fair information principles, which includes openness about your personal data management practices. Dishonesty could lead to fines for violating this law. | Any organization that collects and uses personal information in connection with commercial activities, including selling or sharing donors, membership, or fundraising lists, falls under PIPEDA. |
|
If even just one applies to your business, you’ll need to set your website up for full compliance to avoid getting fined for violating the law.
But don’t worry, I know of a company that can help simplify the whole process for you — it’s Termly (Obviously! Who did you think I’d recommend?).
As the resident Director of Global Privacy, I help our product engineers — the folks who develop our privacy policy generator and consent management platform — with the creation, management, and upkeep of our tools, all of which are designed to help you meet the legal requirements outlined by all seven of those laws (with more to come!).
How Often Should I Update My Privacy Policy?
Privacy policies are living documents that you should review and update every few months — I like to add it as a talking point to our meeting agendas practically every quarter, just to be on the safe side.
But it’s particularly important to make changes whenever you modify the types of data you collect from users or adapt how you use that information.
For proper legal compliance, you must ensure that your privacy policy is always accurate and reflects your current data collection and processing activities.
Additionally, laws like the amended CCPA require you to go through and review your privacy policy at least once a year.
On a more personal note, if I come across a privacy policy that is super old or doesn’t clearly post the ‘last updated’ date on the document, I view it as a major red flag.
Not only does this suggest that the business might not be compliant, but it also makes me wonder what else the company isn’t being transparent about.
Why Do You Need to Inform Users About Privacy Policy Updates?
You should inform users about updates you make to your privacy policy for legal compliance reasons, for example, it’s required by privacy laws or if you target your goods or services to children.
But it’s also best business practice to incorporate privacy by design into your procedures and create an atmosphere of transparency with your customers regarding their data.
Establishing transparency with users by informing them about privacy policy updates builds trust, which is invaluable.
Let me explain more in the next sections.
Build Trust and Avoid Public Backlash
Trust is a necessary part of collecting, processing and using personal data — to earn the trust of your customers, you must be honest with them about how you do all three of these things.
You also need to let them know if and when those processes change and what is explicitly different than before.
Your customers are not just graphs of data to use for marketing and advertising purposes — they’re just like you; human beings who deserve to be treated with respect.
Respect means being transparent about what data you collect about them and explaining how and why you use that information.
You Market to Children
Does your website market to children? If so, you must follow strict, specific guidelines regarding data collection and include detailed information within your privacy policy.
If you make any changes to your processing practices, you must update your policy immediately and inform the parents or legal guardians of those minors.
For example, the Children’s Online Privacy Protection Act (COPPA) protects data collected from users under 13 in the US.
Similarly, the amended CCPA also has stricter guidelines regarding how you obtain consent and if you can sell and share the data from underage users.
How Can You Notify Users About Privacy Policy Updates?
Having a process for notifying your users about your privacy policy updates is just as important as making the updates.
Update notifications are important because laws like the GDPR require you to re-obtain consent from individuals if you want to start collecting new information from them or use their data in ways not previously outlined in your agreement.
I suggest trying to notify your users about the updates you’ve made to your privacy policy by:
- Using a banner or pop-up notice
- Sending out an email update
- Creating a blog or news post
I know it’s tempting, but taking shortcuts isn’t worth it, especially when it comes to privacy compliance, so I recommend implementing more than one of these methods.
Just remember to change the ‘last updated’ date and include it somewhere on your final document so it’s easy for consumers to spot.
Now let’s go over each of these notification methods in more detail.
Banner or Pop-up Notice
Letting users know you’ve updated your privacy policy using a pop-up notice or banner is very simple and effective.
It’s a good idea to implement the banner in a way that users will see it as soon as they come to your site, regardless of what page they land on.
Include a link to your new policy directly on the banner so anyone can easily read it. Explain what’s new using simple language so it’s accessible to as many different readers as possible.
Below, see an example of how the hotel Beaurivage MGM Resort inserted a banner on their site to inform users that they recently updated their privacy agreement.
While I love this method, it shouldn’t be the only thing you do to inform users about your privacy policy changes.
There’s a chance not everyone will see it, especially since you probably won’t permanently leave the pop-up banner on your site. So use this method in combination with other notification solutions.
Privacy Policy Update Email
Another effective way to inform your users about privacy policy updates is by sending an email notification to them.
Remember to include a link to the complete text of the new policy and use simple language to explain what changes you’re implementing. If a legal challenge occurs, you can argue that your users were informed about the changes and had easy access to the new document.
Below, see a great example of a privacy policy update email from the clothing company Everlane detailing their privacy policy changes for the amended CCPA.
Blog or News Post
Ah, blog posts — my personal favorite method for communicating important information to the masses. I highly suggest creating one to highlight your site’s latest privacy policy changes, which doubles as an efficient way to archive older versions of your policies.
Unlike the pop-up banner solution, blog posts live on your site forever, giving your customers more time to read about the changes you’ve made to your policy.
And, if a legal dispute arises, having a proper log of the past iterations of your policy can help you prove that you’ve implemented the appropriate updates and changes following relevant data privacy laws.
Below, see an example of the blog post where the National Basketball Association (NBA) puts details about all changes they’ve made to their privacy policy.
They continually add to this archive whenever another update occurs, which I recommend you also do.
Oh, and at the risk of sounding like a broken record, remember to link directly to the most current version of your privacy policy in your blog post.
How to Update Your Privacy Policy
In this next section, I’m going to teach different ways you can quickly and easily update your privacy policy.
Managed Solution
The thing I recommend the most to business owners looking for the easiest way to make and update a privacy policy is a managed solution, like our Privacy Policy Generator.
Our generator asks you simple, relevant questions about your business’s data privacy processes and kicks out a legally compliant, thorough, and properly formatted policy for you based on your answers. No hassles, no fuss.
When it’s time to make a change, you simply pop back into the Termly dashboard anytime and make the updates directly in the builder.
It then automatically applies the changes to the published version of your privacy policy embedded on your website — super easy, right?
Below, see a sample of what our privacy policy generator looks like.
Update Your Privacy Policy Template
I also like suggesting people try using a free privacy policy template because they are easy to update and a good starting point for businesses on a budget.
You must manually fill in blank sections of a template with information about your business, so it requires more hands-on work.
But when it’s time to make some updates, you simply go back into the document, find the necessary clauses or features, and write in the new information yourself.
Below, see a sample of our privacy policy template.
Writing It Yourself
If you wrote your own privacy policy and it needs updating, you can just open up the original document and edit the sections that need to be changed.
But to make the process easier for you, I have a few tips and tricks:
Privacy Policy Updates FAQs
I could — and often literally do — talk about privacy policies all day, so if you still have questions about updating yours, check out answers to some frequently asked questions on the topic below.
How often do I need to update my privacy policy?
You must update your privacy policy whenever your data privacy practices or procedures change. Under laws like the CCPA, you must update it once every 12 months.
How do I notify users of privacy policy updates?
You can quickly notify users about your privacy policy updates by putting a ‘last updated’ date on your policy, sending out a blast email, publishing a blog post, and using a pop-up or website banner to inform people about the changes.
Why are all the privacy policies changing?
Privacy policies change when companies implement new privacy protocols or in an effort to abide by legal obligations.
For example, the CCPA requires all entities to update their privacy policy once every 12 months.
Why did so many privacy policies update in 2018?
In 2018, the GDPR entered into force, and many businesses updated their privacy policies to meet the requirements outlined by the regulation.
Despite passing into law in 2018, the GDPR didn’t come into action until 2020, the same year the CCPA was implemented, so another wave of privacy policy updates occurred that year.
Summary
Updating your privacy policy is an important part of complying with privacy laws and helps keep your consumers properly informed.
Remember to always include a ‘Last Updated’ date near the title of your policy, keep an archive of past versions, and update your users whenever you make changes.
Luckily, you can use resources like our Privacy Policy Generator to seamlessly integrate all of your future updates and keep lines of communication open with your customers.
More about the author
Written by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Masha is an Information Security and Data Privacy Specialist and a Certified Data Protection Officer. She has been a Data Protection Officer for the past six years, helping small and medium-sized enterprises achieve legal compliance. She has also been a privacy compliance mentor to many international business accelerators. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD). Masha studied Law at Belgrade University, and she passed the Bar examination in 2016. More about the author
