Website Privacy Policy and Cookie Notice in Plain English

A website privacy policy is the page that tells visitors, in honest and readable terms, what information your site collects, why you collect it and what they can do about it. If your small business site has a contact form, a newsletter box or even basic analytics, you almost certainly need one, plus a short cookie notice to go with it. This guide walks you through both pages step by step, in plain English, so you can write something clear, accurate and easy to maintain.

One note before we start: this article is general guidance, not legal advice. Privacy rules differ by country, state and industry, so we will remind you to check your local requirements along the way.

What These Two Pages Actually Do

Think of your website as a shop. A privacy policy is the sign by the till that explains what you write down about customers and what you do with it. A cookie notice is the polite warning at the door that says, ‘we use a few small tracking tools in here, and here is how you can say no to the optional ones.’

They are related, but they do different jobs:

• The privacy policy is a full explanation of the personal information you collect, the reasons, who you share it with, how long you keep it and how people can contact you about it.
• The cookie notice is a shorter, more specific message about cookies and similar technologies, usually shown as a banner or pop-up, often with a link to a longer cookie section.
• Both should match what your site really does. A beautifully written page that describes tools you no longer use, or misses ones you do, is worse than a simple page that is correct.

Many small businesses copy a template, paste it in and forget it. The result is a website privacy policy that sounds official but does not describe the actual business. Visitors notice, and regulators or customers who ask questions may notice too. Writing your own plain-English version, even from a template, is mostly about being accurate.

Before You Write: Map What Your Site Collects

You cannot explain data collection until you know what is being collected. Set aside an hour and do a simple inventory, the way you would count stock before writing a price list.

Step 1: List Every Tool on Your Site

Walk through your website as a visitor and note anything that asks for information or loads something from another company. Then check behind the scenes: your WordPress plugins, your email marketing platform, your booking or checkout system and any scripts added by an agency or freelancer. If you are not sure what is installed, your hosting dashboard, plugin list or a developer can help.

Step 2: Note What Each Tool Collects and Why

For each tool, write down what information it gathers, the reason you use it, and which company handles it. The table below shows common examples. The details vary by provider, so always check each tool’s own documentation rather than assuming.

If a contact page is part of your site, it is worth checking what it collects too. Our guide on how to write a website contact page that gets enquiries pairs nicely with this step, because the form you build there is one of your main data collection points.

What a Small Business Privacy Policy Should Cover

Once your inventory is done, the structure of the page almost writes itself. Exact requirements depend on where you operate, but most small business policies cover the same core topics.

• Who you are: your business name, and how to reach you with privacy questions, such as an email address or postal address.
• What you collect: the types of information, grouped sensibly, such as details people give you directly and details collected automatically when they browse.
• Why you collect it: the purpose for each type, such as answering enquiries, delivering orders or improving the site.
• Who you share it with: service providers such as your email platform, payment processor, hosting company or analytics provider. You do not need a dramatic list, just honesty about the categories and, where practical, the names.
• How long you keep it: a realistic description, even if it is ‘as long as needed to handle your enquiry or meet our legal and accounting obligations.’
• Visitor choices and rights: how people can ask to see, correct or delete their information, or unsubscribe, where the law gives them those options.
• Cookies: a short summary and a link to your cookie notice or cookie section.
• Security and children: a brief, truthful line on how you protect data, and a statement if your site is not meant for children.
• Updates: a ‘last updated’ date and a note that the policy may change.

Do not promise more than you do. Writing ‘we never share your data’ is risky when your email provider, hosting company and payment processor all handle it on your behalf. ‘We only share it with the companies that help us run the business, and only for that purpose’ is usually closer to the truth.

Basic protection matters here as well. If your policy says you look after visitor data, your site should back that up. Our article on website security basics for small businesses covers practical steps you can take.

How to Explain Data Collection in Plain English

Good privacy writing sounds like a helpful shop owner, not a contract. A website privacy policy that people can actually read builds trust, and it is easier for you to keep accurate because you understand every sentence.

Use Short Sentences and Everyday Words

Say ‘we’ and ‘you’. Replace legal-sounding phrases with simple ones. Define any unavoidable term the first time it appears, for example: ‘Cookies are small text files that a website stores on your device so it can remember things, like what is in your basket.’ An analogy helps: a cookie is like a cloakroom ticket, it lets the site recognise your coat when you come back.

Organise by Questions Visitors Actually Ask

Use clear headings such as ‘What We Collect’, ‘Why We Collect It’ and ‘How to Contact Us About Your Data’. Add a short summary at the top for people in a hurry. Break long paragraphs into lists, and avoid hiding important points in the middle of dense text.

Be Specific Instead of Vague

‘We use analytics to see which pages are most visited’ tells people far more than ‘we collect usage data.’ Specific statements are also easier to check against reality, which keeps you honest.

Writing a Cookie Notice People Can Understand

A cookie notice usually has two layers: a short banner and a slightly longer explanation behind it. The banner should say what is happening in a sentence or two. The explanation should group cookies by purpose, so visitors can make sense of them.

The last column is deliberately cautious. Some regions require visitors to opt in before non-essential cookies are set, while others focus on notice and an easy way to opt out. That is exactly the kind of detail to confirm for your own location and audience.

Banner Habits That Build Trust

• Make ‘accept’ and ‘reject’ or ‘manage settings’ equally easy to find, rather than hiding the choice.
• Keep the wording short, and link to the full explanation.
• Do not load optional tracking tools before a visitor has had the chance to choose, if your local rules call for that.
• Let visitors change their mind later with a clearly labelled link, such as ‘Cookie Settings’ in the footer.
• Test the banner on a phone, since a banner that covers the whole screen frustrates people.

Many small businesses use a consent tool or plugin for this. That is fine, but a tool only works if it is configured to match what your site really loads. Check it after setup by browsing your site in a private window and reviewing what you see.

Keeping Both Pages Accurate as Your Tools Change

This is where most privacy pages quietly fail. You add a booking plugin, switch email providers or install a new chat widget, and nobody updates the policy. Six months later, the page describes a business that no longer exists.

The fix is to make your website privacy policy part of normal site care, not a one-off project. Here is a simple routine:

• Add a privacy question to every change. Before installing a plugin, embedding a form or starting a campaign, ask: does this collect new information, or share it with a new company?
• Keep your inventory sheet. The list you built earlier is your master document. Update it whenever a tool is added or removed.
• Review on a schedule. Pick a regular rhythm, such as every few months, and compare the inventory with the policy and the cookie notice.
• Re-test the cookie banner. After site updates, theme changes or plugin updates, confirm that the banner still appears and that your choices still work.
• Update the date. When you change the policy, change the ‘last updated’ line so visitors can see it is current.
• Note big changes. If you start using data in a meaningfully different way, consider telling existing customers or subscribers, and check whether your local rules require it.

If you already follow a routine for updates and backups, add privacy to it. Our essential website maintenance checklist for small businesses is a natural home for this task, so it does not rely on someone remembering.

Placement, Review, and Local Legal Checks

Once your pages are written, make them easy to find. Link to the privacy policy in your site footer so it appears on every page, and link to it near any form that collects personal details, such as your contact, booking or newsletter forms. Link the cookie notice from the banner and from the footer.

Check the Rules Where You and Your Visitors Are

Privacy law is not the same everywhere. Rules can depend on where your business is based, where your visitors live and what you sell. Some places require specific wording, specific rights for individuals or consent before certain cookies. If you serve visitors in Europe, for instance, data protection rules such as the GDPR may apply, and they can also affect how you approach marketing and search. Our overview of the impact of GDPR on SEO is a useful starting point for understanding how those rules touch your website.

Use official government or data protection authority websites as your reference, and consider asking a qualified lawyer to review your final pages, especially if you handle sensitive information, take payments, run advertising or work in a regulated industry. A short review is usually cheaper than fixing a problem later.

A Quick Final Checklist

• Does the policy name your business and give a working contact method?
• Does it list every tool that collects or shares visitor information?
• Is the language simple enough that a friend outside your industry would understand it?
• Does the cookie banner match what your site actually loads?
• Is there a visible ‘last updated’ date?
• Have you checked your local legal requirements?

Conclusion: Start Simple and Keep It True

You do not need a wall of legal text to be transparent with visitors. Start by listing what your site collects, explain each item in everyday words, add a clear cookie notice with real choices, and link both pages where people will see them. Then keep your website privacy policy honest by updating it whenever your tools change, and confirm your local legal requirements with official sources or a qualified professional. A short page that is accurate and readable will serve your customers, and your business, far better than a long one nobody trusts.