Home › Resources

How to Add a Privacy Policy to Your Website

Published August 20, 2026

Adding a privacy policy to your website means creating a document that explains how you collect, use, and protect visitor data, then placing it where users and regulators can find it. The policy needs to be publicly accessible from every page on your site, typically through a footer link, and it should also appear near any form that collects personal information such as email signups, contact forms, and checkout pages.

Privacy laws including the GDPR, CCPA, and PIPEDA all require websites that collect personal data to publish a clear privacy policy. Even if your site only runs basic analytics or sets cookies, those laws apply. Failing to post a policy can result in fines, loss of user trust, and rejection from advertising networks and payment processors that require a linked policy before approving your account. The steps below walk through where the policy link belongs, how to generate the text, how to host it, and how to set it up on WordPress, Wix, Squarespace, and Shopify.

Where the Privacy Policy Link Belongs

The most important placement is the website footer. Because the footer appears on every page, a privacy policy link there satisfies the CalOPPA requirement that the policy be "conspicuously posted" and the GDPR requirement that it be "easily accessible." The link text should include the word "Privacy" so visitors recognize it immediately, something like "Privacy Policy" or "Privacy Notice."

Beyond the footer, you should place a privacy policy link in three additional locations:

• Signup and registration forms. Any form where a visitor creates an account or subscribes to a newsletter should link to your privacy policy near the submit button. Under the GDPR, consent must be informed, meaning the user needs to know how their data will be handled before they click "Sign Up." Many sites add a short line such as "By signing up you agree to our Privacy Policy" with a hyperlink to the full document.
• Contact and checkout forms. When someone submits a contact form or enters payment details, they are handing over personal data. A privacy policy link near the form reassures users and provides the legal disclosure required by regulations like the CCPA, which gives California residents specific rights over data collected during transactions.
• Cookie consent banners. If your site uses cookies for analytics, advertising, or personalization, the GDPR requires a cookie consent mechanism that lets EU visitors opt in before non-essential cookies fire. The banner should link to your privacy policy so visitors can read the full details before making a choice.

Placing the link in all four locations, footer, signup forms, checkout or contact forms, and the cookie banner, ensures that no matter how a visitor interacts with your site, the policy is never more than one click away.

Generating the Policy Text

A privacy policy needs to cover what data you collect, why you collect it, who you share it with, how long you keep it, what rights users have, and how to contact you about privacy concerns. Writing this from scratch requires mapping every data flow on your site, from form inputs to analytics SDKs to embedded third-party scripts, and then translating each flow into plain-language disclosures.

A faster approach is to use a privacy policy generator that walks you through a structured questionnaire. You select your platforms, check the third-party services your site uses (Google Analytics, payment processors, ad networks), indicate which regions your visitors come from, and the tool produces a document covering each required section. The output is ready to paste into a hosted page or download as HTML.

Whichever method you use, make sure the finished policy covers these areas at minimum:

• Types of personal data collected (names, email addresses, IP addresses, device identifiers, cookies)
• Purpose of collection for each data type
• Third-party services that receive user data, listed by category and name
• Data retention periods
• User rights under applicable laws (access, deletion, opt-out of sale)
• Contact information for privacy inquiries
• How users will be notified of policy changes

After generating or writing the text, review it against your actual data practices. A generated policy is only as accurate as the answers you provided during setup. If you later add a new analytics tool or start collecting a new data type, update the policy to reflect the change.

Hosting It at a Public URL

Your privacy policy must live at a permanent, publicly accessible URL on your own domain, something like yoursite.com/privacy-policy. It cannot sit behind a login wall, inside a PDF that requires a download, or on an editable third-party page like a Google Doc. Advertising networks, payment processors, and app stores all check that the privacy policy URL resolves to a real, publicly viewable HTML page.

If your website builder or CMS supports custom pages, create a dedicated page for the policy. Most platforms (WordPress, Wix, Squarespace, Shopify) have built-in tools for this, which the next section covers. If you are building a static site or using a framework, create a route or HTML file at a clean URL path and paste the policy text into it.

Some generator tools offer free hosting for the policy page itself, giving you a stable URL you can link to from your footer and forms without managing the page in your own CMS. This works well for developers who want to keep their codebase minimal and update the policy through the generator's interface instead of editing source files.

Platform Steps: WordPress, Wix, Squarespace, Shopify

WordPress

WordPress has a built-in privacy policy tool. In your dashboard, go to Settings > Privacy. You can select an existing page or click Create New Page, which generates a template with recommended sections. Edit the template under Pages > All Pages, fill in your site-specific details, and publish. To add the link to your footer, go to Appearance > Menus, add the Privacy Policy page to your footer menu, and save. If your theme uses widgets for the footer, add a Navigation Menu widget pointing to the policy page instead.

Wix

Wix provides a privacy policy page template in the site editor. Open the Wix Editor, click Add Page, and search for "Privacy Policy" in the page templates. Wix also lets you paste custom text into a blank page if you prefer to use a generated policy tailored for Wix sites. To link it from the footer, open the footer section in the editor, add a text element or button, and link it to your privacy policy page. Wix sites created for EU audiences automatically add a cookie consent bar; make sure your privacy policy URL is linked within it.

Squarespace

In Squarespace, create a new page under Pages > Not Linked (so it does not appear in the main navigation), paste your policy text, and publish. Then go to Settings > Design > Custom CSS or use the built-in footer editor to add a link to the page. Squarespace also has a cookie banner under Settings > Cookies & Visitor Data where you can link to your policy. For a policy that covers Squarespace-specific data practices like form submissions and commerce transactions, see our Squarespace privacy policy guide.

Shopify

Shopify can auto-generate a basic privacy policy. In your Shopify admin, go to Settings > Legal and click Create from template under Privacy Policy. Shopify fills in a starter document that you should review and edit to match your actual data practices, especially if you use third-party apps that collect customer data. The generated policy is automatically linked in your checkout footer. To add it to your store's main footer, go to Online Store > Navigation, open your footer menu, and add a link to the privacy policy page.

Linking It From App Store Listings

If your website also has a companion mobile app, both Google Play and the Apple App Store require a privacy policy URL in the app listing. Google Play will not approve an app that requests sensitive permissions without a linked policy, and Apple requires a privacy policy URL in App Store Connect for every submission, regardless of what data the app collects.

The simplest approach is to use the same privacy policy page you already host on your website. Paste the URL into Google Play Console under App content > Privacy policy and into App Store Connect under App Information. Make sure the page covers data collected by mobile SDKs (analytics, crash reporting, ad networks) in addition to website data, since the app stores expect the policy to reflect the app's actual data practices, not just the website's.

If your app collects data that your website does not, or vice versa, consider adding platform-specific sections to the same policy document rather than maintaining two separate policies. A single URL that covers both platforms is easier to keep updated and avoids confusion when store reviewers cross-check the policy against declared data types. For a deeper walkthrough of app-specific requirements, see our guide to writing a privacy policy for an app.

Once your policy is published and linked everywhere it needs to be, run a quick check to make sure the URL loads correctly, the text matches your current data practices, and every form and footer on the site points to the right page. You can audit your existing policy to catch gaps before a regulator or app store reviewer does.

Frequently Asked Questions