A privacy policy is a legal document that explains how an organization handles any customer, client or employee information gathered in its operations. It will include how data is collected, stored, used, shared and protected and the user’s rights in connection to the data. It is required by law in the European Union, the State of California and other jurisdictions.

A privacy policy might be required for privacy compliance.

A privacy policy should specify any personally identifiable information (PII) that is gathered, such as name, address and credit card number, as well as other information like order history, browsing habits, uploads and downloads. The policy should also explain if data can be left on a user’s computer, such as cookies. The policy should disclose if data can be shared with or sold to third parties and if so, what the purpose is.

For simple privacy policies, the first statement found in an online privacy policy is one to the effect that, by visiting the webpage (which you are doing if you’re reading the policy), you agree to the details of the site’s privacy policy. Some jurisdictions now require that the consumer give active consent, meaning that this type of clause is no longer binding.

Many sites now use a clickwrap (click through) agreement to prove user agreement to a privacy policy. These are much more defensible in court than policies that rely on passive agreement, such as by simply using a site. Clickwrap agreements often pop up at the bottom of a site with an accept or reject prompt. Adding a checkbox affirming that the consumer read and understood the terms of the privacy policy can further protect the organization. The date, time and identifying information of the acceptance should be tracked.