Nobody thinks about a privacy policy until someone asks for it. A client’s lawyer wants to see it. Your Facebook ad account gets flagged without one. A visitor asks how you use their info, and your site has nothing to point to.
I get why this feels like a chore. It sounds like legal stuff, and most of us didn’t start a business to read law. But a privacy policy for your website isn’t optional anymore, even for a small, local business. Most platforms won’t let you run ads or collect leads without one.
Here’s the good news: it’s simpler than it sounds. Let’s start with the one law most Canadian small businesses need to know, then walk through what to actually put on the page.
Why a privacy policy for your website matters now
A privacy policy used to be generic text nobody actually read. Now it’s tied to real fines and real platform rules. Do you run Facebook or Google ads, collect emails through a form, or use a booking tool? Then you’re collecting personal info, whether you think of it that way or not.
The platforms you already use require a visible privacy policy as part of their terms. Most business owners only find this out the first time an ad account gets flagged for missing one. Not a fun surprise.
A privacy policy also builds trust. A visitor who sees a clear, honest page about how you use their info feels safer filling out a form or buying something. Nobody likes handing over their email into a black box.
PIPEDA: the law most Canadian businesses need to follow
If your business runs in Canada, the law that applies to you is called PIPEDA. That stands for the Personal Information Protection and Electronic Documents Act. Think of it as Canada’s main privacy rulebook for businesses.
It covers most businesses that collect, use, or share personal info as part of running a business, so that likely includes you. According to the Office of the Privacy Commissioner of Canada, PIPEDA runs on ten principles. In short, get real consent before you collect info, only collect what you need, keep it secure, and stay upfront about your practices. A few groups get a pass, like not-for-profits, but most small businesses selling goods or services are covered.
In plain terms, your website needs to tell visitors what you collect and why you collect it. It also needs to say how you protect that info and how they can ask you to delete it. That’s the heart of what belongs on your privacy policy page.
What GDPR, CCPA, and COPPA add if you sell outside Canada
If your audience is mostly Canadian, PIPEDA covers most of what you need. Sell to clients in the EU or California? Work with anyone under 13? A few more laws come into play.
GDPR protects the data of anyone in the European Union, no matter where your business is based. It gives people the right to see, fix, and delete their info, and it needs clear consent before you collect it. Even a handful of EU visitors brings this law into play.
CCPA works the same way for California residents. It lets them know what you collect, opt out of having it sold, and ask you to delete it. It kicks in based on revenue and how much data you handle, so most small Canadian businesses fall outside it. Still worth a check if you market to a US audience.
COPPA is different. It protects kids under 13 in the US. It applies if your site targets kids, or if you knowingly collect info from anyone under 13. The Federal Trade Commission’s COPPA page lists steep fines for violations. The exact number changes over time, so check the FTC directly if this one applies to you. Most small business sites never bump into COPPA. It matters if you run something aimed at kids, like a youth program or a kids’ product line.
What to actually put on your privacy policy page
A good privacy policy for your website doesn’t need to sound like a legal contract. It just needs to be clear, honest, and easy to find. At minimum, name plainly what you collect, whether that’s names, emails, payment info, or analytics data.
Say why you collect it too. Maybe it’s to send a newsletter, process an order, or run ads. Just say so. Then say whether you share it with anyone else, like an email platform, a payment processor, or an ad network.
Tell people how to reach you with privacy questions, and how to ask you to delete their info. PIPEDA requires this part, and it also builds the most trust with a visitor who’s on the fence about handing over their email.
Most website platforms offer a starter template. Squarespace, Wix, and plenty of WordPress plugins have one built in, which is a fine starting point for a simple small business. Selling internationally, handling sensitive info, or working in a regulated field like health or finance? It’s worth having a lawyer look over the final page.
A privacy policy is one small trust signal, not the whole job
A privacy policy does a lot of quiet work for one small page. It protects your business, keeps you in line with the platforms you advertise on, and tells a visitor you take their info seriously. None of that takes a legal background. It just takes an honest page that says what you actually do with the data you collect.
If your website is missing other trust signals too, that’s worth a look while you’re at it. This guide to what most websites are missing covers a few more.
Related reading: For a broader look at the legal risks small business websites face, read Legal Threats Lurking? Ensure Your Website Is Bulletproof.
Frequently Asked Questions
Do I legally need a privacy policy on my small business website?
In most cases, yes. If you collect any personal info through your site, like a contact form, email signup, or checkout, PIPEDA requires a privacy policy in Canada. Most ad platforms won’t let you run ads without one either.
What is PIPEDA and does it apply to my business?
PIPEDA is Canada’s federal privacy law for the private sector. It covers most businesses that collect, use, or share personal info as part of running a business. That’s most small business websites in Canada.
Do Canadian businesses need to follow GDPR or CCPA too?
Only if you have visitors or clients in the EU or California. GDPR follows the visitor, not your business location, so even a little EU traffic can bring it into play. CCPA has revenue and data thresholds most small businesses fall under, but check if you market to US clients.
What should a privacy policy actually include?
Say what personal info you collect and why. Say whether you share it with anyone, like an email platform or payment processor. Tell visitors how to contact you or ask you to delete their info.
What happens if I don’t have a privacy policy?
You could lose access to ad platforms that require one, and you may fall out of line with privacy laws that apply to you. Visitors also trust a site less when it’s vague about how it uses their info.
A privacy policy for your website doesn’t need to be complicated. Say what you collect, why you collect it, and how someone can ask you about it. Start with PIPEDA if your audience is mostly Canadian, then add GDPR or CCPA language if you sell further afield. Keep the page honest and easy to read. That one page can be the difference between an ad account that runs smoothly and one that gets flagged over a detail nobody thought to check.