The Short Version
If your website uses Google Analytics, has a contact form, sells anything online, or simply loads in a browser, it collects personal data. That means you need a privacy policy — and in most jurisdictions, that requirement is not optional. The question isn’t whether your business needs a privacy policy; it’s whether your current policy (if you have one) actually covers what the law requires. This guide covers the major legal frameworks that apply to US businesses, what a compliant policy must contain, and the most common mistakes that make policies unenforceable.
The Laws That Apply to Your Website
Privacy law in the United States is fragmented across federal sector-specific regulations, state-level comprehensive laws, and international frameworks that apply based on who visits your site — not where you’re incorporated. The following frameworks are most likely to apply to a typical Massachusetts small business:
GDPR (General Data Protection Regulation)
The European Union’s GDPR applies to any organization that processes personal data of EU residents — regardless of where the organization is located. If you have any EU visitors, you’re potentially in scope. GDPR is the most demanding framework, with requirements for explicit consent, data subject rights, data breach notification (72 hours to regulators), and data processing agreements with vendors.
CCPA/CPRA (California Consumer Privacy Act)
California’s CCPA, strengthened by the CPRA in 2023, applies to for-profit businesses that meet any of these thresholds: annual gross revenue over $25 million, buy/sell/share personal information of 100,000+ California consumers or households annually, or derive 50%+ of annual revenue from selling personal information. Even below these thresholds, California residents have privacy expectations that affect how you communicate about data practices.
Massachusetts 201 CMR 17.00
Massachusetts has one of the country’s stronger state privacy frameworks. 201 CMR 17.00 applies to any person or organization that owns or licenses personal information about Massachusetts residents — including businesses located outside Massachusetts. It requires a written information security program (WISP), reasonable security measures, and specific breach notification procedures.
What Counts as Personal Data
The definition of personal data is broader than most businesses assume. It includes obvious identifiers — names, email addresses, phone numbers, physical addresses — but also:
- IP addresses (confirmed as personal data under GDPR)
- Cookie identifiers and device fingerprints
- Behavioral data (pages visited, clicks, session duration) when linked to an identifier
- Location data
- Employment information
- Financial information (payment method types, not necessarily card numbers)
- Health and medical information (HIPAA applies additional requirements)
Google Analytics, by default, collects IP addresses and uses cookies to track returning visitors. Your contact form collects names and email addresses. Your e-commerce platform stores order history. All of this constitutes personal data under current legal frameworks.
What Your Privacy Policy Must Cover
A legally adequate privacy policy must answer specific questions that regulators and courts look for:
What data you collect
List the categories of personal data collected, organized by collection method (form submission, cookies, analytics, account creation). Vague language like “we may collect certain information” creates legal exposure — specificity is protective.
Why you collect it (legal basis under GDPR)
Under GDPR, every data processing activity must have a documented legal basis: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. For most small businesses, the primary bases are consent (for marketing) and contract performance (for service delivery). You must document and disclose which basis applies to each processing activity.
How long you keep it
Retention periods are legally required under GDPR and are becoming expected under other frameworks. “We keep your data until you ask us to delete it” is not a retention policy. You need to specify: transaction records are retained for 7 years (for tax purposes), marketing preferences are retained until unsubscribed, analytics data is retained for 26 months, etc.
Who you share it with
List all third parties that receive personal data: your CRM vendor, email marketing platform, analytics provider, payment processor, cloud hosting provider, and customer support tools. Sharing includes providing access — not just selling. If your customer data sits in a Zoho CRM that Zoho can access for support purposes, that’s a third-party relationship to disclose.
User rights
GDPR grants data subjects eight rights. CCPA grants California residents similar rights. Your policy must explain these rights and provide a mechanism to exercise them: access (get a copy of their data), rectification (correct inaccurate data), erasure (delete their data), restriction, portability, objection, and rights related to automated decision-making.
The GDPR Trap for US Businesses
Many US businesses assume GDPR doesn’t apply to them because they’re not in Europe. This is incorrect. GDPR applies based on the location of the data subject — not the controller. If you have any EU visitors, you process EU personal data.
The practical question is enforcement risk. The EU has limited enforcement mechanisms against US companies that don’t have EU operations, EU customers, or EU employees. But GDPR compliance is also becoming a commercial requirement — many enterprise customers and partners require vendors to have documented GDPR-compliant data handling as part of vendor due diligence.
California’s CCPA
Even businesses below the CCPA threshold should understand its requirements, because California sets the de facto national standard and other states have passed similar laws. As of 2025, comprehensive state privacy laws are in effect in Virginia, Colorado, Connecticut, Texas, Montana, Iowa, Indiana, Tennessee, and others — with more in progress.
The CCPA requires a “Do Not Sell or Share My Personal Information” link if you sell or share personal data (which includes sharing for targeted advertising). It also requires a privacy policy that’s accessible from every page of your website — not just the homepage.
Massachusetts Privacy Requirements
Massachusetts residents have specific rights under state law. The Massachusetts data breach notification statute (M.G.L. c. 93H) requires notification to affected residents and the Attorney General whenever a breach of personal information occurs — with no minimum threshold for the number of affected individuals.
Personal information under Massachusetts law includes: name combined with SSN, driver’s license number, financial account numbers, or health/medical information. The definition is narrower than GDPR but the notification requirements are strict.
What Makes a Privacy Policy Legally Weak
- Copy-paste from a competitor: If your privacy policy was copied from another site, it likely doesn’t accurately describe your actual data practices — and a mismatch between your policy and your practices is worse than no policy.
- No contact information for privacy requests: Every privacy framework requires a mechanism for data subjects to exercise their rights. A policy without a privacy contact email or physical address is incomplete.
- Not updated after tool changes: Adding a new CRM, switching analytics platforms, or adding a chatbot changes your data processing — and your policy must reflect it. Undisclosed processing creates legal exposure.
- Buried or inaccessible: Regulators and courts expect privacy policies to be “conspicuously posted” — linked from the footer of every page at minimum, and from any form that collects personal data.
Check Privacy Policy Generator — Free
Answer questions about your website, the data you collect, and the tools you use, and the generator produces a compliant privacy policy covering GDPR, CCPA, and Massachusetts requirements. The output is HTML you can paste directly into your website.
Nicholas Salem is the CEO of Boston Managed IT, a managed services provider serving professional services firms and small businesses across Greater Boston. BMIT helps clients build and operate security programs that meet Massachusetts compliance requirements.
