Drafting and Maintaining a Privacy Policy: A Practical Guide

Summary. This guide walks a company, its lawyers, and anyone reading a privacy policy against it through the life of the document in the order the work actually happens: scoping the project, deciding which laws apply, building the fact base from a data map, vendor list, network capture, and retention schedule, and making the business decisions the policy will describe. It then covers drafting the full policy, the notices at collection, and the just-in-time notices; designing consent flows, opt-out links, and Global Privacy Control handling that survive the dark-pattern rules; and verifying every sentence against a named source of truth before launch. It explains how to publish, archive, and give notice of changes, when a change requires affirmative express consent under the FTC's Gateway Learning rule, what the formation cases from Douglas and Stover to Schnabel require of a change notice, and how to run the twelve-month update cycle and the annual accuracy audit. It covers what to do when a demand letter, a regulator's investigative demand, or an acquirer's diligence request tests the policy, with strategy for each side. A worked example follows an online retailer through a ten-week rebuild of its policy for a loyalty launch, and the guide closes with special situations, timelines and costs, common mistakes, an FAQ, and practical takeaways.

The request reaches legal on a Monday. The loyalty app ships in ten weeks, Apple's submission form wants a privacy policy URL and a completed privacy label, and marketing has added "just a few" SDKs. The policy on the website was written in 2021, for a company with one product and no app, by someone who left two years ago.

Ten weeks is enough to do this properly, but only if the work happens in the right order, and the order surprises people: the writing comes near the end. This guide lays out that order step by step. It is written for the in-house lawyer or outside counsel running the project and for the founder doing it without one, and also for the people who read the finished document against the company: the plaintiff's lawyer holding a network capture, the regulator, and the acquirer deciding what a customer database is worth. The companion article, Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC, explains the law in depth. This guide turns it into steps.

The short answer

• Facts first, words last. A privacy policy is a set of factual representations, enforceable under Section 5 of the FTC Act, 15 U.S.C. § 45, under California's posting statute and the state privacy laws, and in private litigation as the measure of consent and expectation. You cannot write a true sentence about a practice nobody has mapped, so most of the project is scoping, fact-finding, and business decisions. Drafting is the last third.
• Fifteen steps in four phases. (1) Scope the project, decide which laws apply, build the fact base, and make the business decisions. (2) Choose the architecture, draft the full policy, draft the notices at collection and the just-in-time notices, and build the consent mechanics. (3) Verify every sentence, align every other public statement, approve and publish, and give notice of the changes. (4) Run change control, the annual review, and the records program.
• Timing. A simple single-site business can finish in two to three weeks. A mid-market company with an app, a loyalty program, and multi-state customers needs eight to twelve weeks. An enterprise program build takes one to two quarters. Every material change after launch reruns a compressed version of Steps 3 through 12.
• The rules that set the calendar. Update at least every 12 months if the CCPA applies. Give actual notice of a material change before it takes effect. Get affirmative express consent before applying a material change to data you already hold. Make consent precede the collection it authorizes. Keep every version, with proof of what users saw and when.
• For the other side, the same steps are a roadmap for testing a policy: pull every version, capture the traffic, exercise the choices, and compare.

The legal framework in one place

No single federal statute requires a privacy policy. The obligation to publish one comes from state law, the sector statutes, and the contracts of the app stores and ad platforms; the obligation to make it true comes from everywhere at once. The table lists what each source demands of the document and what that demand does to the project plan.

The companion article walks through each source. Here we care about what each one makes you do, and when you have to do it.

The decisions that shape the process

Six lines of authority explain why the steps below are in the order they are. Each comes with the step it drives.

Every sentence is a representation, read for its net impression. In FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), the Third Circuit upheld the FTC's authority to treat inadequate data security as an unfair practice, in a case whose complaint also pleaded deception built on the hotel chain's privacy-policy security promises. The FTC reads all the layers together: accurate fine print does not cure a misleading summary, FTC v. Cyberspace.com LLC, 453 F.3d 1196 (9th Cir. 2006); the agency may identify implied claims from the face of a statement without consumer surveys, Kraft, Inc. v. FTC, 970 F.2d 311 (7th Cir. 1992); and objective claims require a reasonable basis at the time they are made, POM Wonderful, LLC v. FTC, 777 F.3d 478 (D.C. Cir. 2015). A sentence like "your data is anonymized" is an objective claim. The tests come from the FTC's Deception Policy Statement, appended to Cliffdale Associates, Inc., 103 F.T.C. 110, 174 (1984), and its Substantiation Policy Statement, appended to Thompson Medical Co., 104 F.T.C. 648, 839 (1984), and the agency's consent orders have built them into what Daniel J. Solove and Woodrow Hartzog call a common law of privacy, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583 (2014). That is why Step 9 ties every sentence to a record and an owner.

Specific statements control, in both directions. In Calhoun v. Google LLC, 113 F.4th 1141 (9th Cir. 2024), the Ninth Circuit reversed summary judgment for Google on consent because a reasonable user reading all of Google's disclosures, including a Chrome-specific notice saying that personal information would not be sent to Google unless the user turned on sync, might not have understood that the collection was happening. In In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), a help-center answer about logged-out browsing helped establish the reasonable expectation of privacy that revived the intrusion and California constitutional privacy claims. In In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), a "HEY GROWN-UPS" assurance on a registration page kept an intrusion claim, the tort described in Restatement (Second) of Torts § 652B (Am. L. Inst. 1977), alive against the company that made it.

The same rule protects an accurate drafter. In Hammerling v. Google LLC, No. 22-17024 (9th Cir. Mar. 5, 2024), an unpublished decision, Google's policy defined its "services" to include the Android operating system and disclosed collection of activity in "apps that use our services," and that express disclosure defeated fraud, contract, and privacy claims together. In Smith v. Facebook, Inc., 745 F. App'x 8 (9th Cir. 2018), general disclosures of off-site data collection established consent. Steps 6 and 10 exist because of these cases: write the specific statements on purpose, and make every other public statement agree with them.

Consent must come first, and the company must be able to prove it. In Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022), another unpublished decision, the Ninth Circuit read California's wiretap statute to require prior consent, so agreeing to a policy after a session-replay script had already recorded the visit cured nothing. In Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022), the implied-consent question was remanded, and a company witness could not produce the policy as it stood in 2018. Consent is generally an affirmative defense the defendant must prove (the Ninth Circuit said so of TCPA consent in Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017)), and under the Wiretap Act it "should not casually be inferred," In re Pharmatrak, Inc., 329 F.3d 9 (1st Cir. 2003). Steps 8 and 15 are the response.

A change binds only people who learn of it. Posting revised terms does not bind existing customers who were never told, Douglas v. U.S. District Court, 495 F.3d 1062 (9th Cir. 2007). A change-of-terms clause works only if both parties have notice of the change, and a later visit to the website is not notice, Stover v. Experian Holdings, Inc., 978 F.3d 1082 (9th Cir. 2020). Terms emailed after enrollment, followed by nothing more than a failure to cancel, were not accepted in Schnabel v. Trilegiant Corp., 697 F.3d 110 (2d Cir. 2012), which applied the rule that conduct counts as assent only when the actor knows or has reason to know it will be read that way (Restatement (Second) of Contracts § 19(2) (Am. L. Inst. 1981)), and the Second Circuit observed that requiring an express acknowledgment would likely have cured the problem. An unrestricted right to change terms at will helped make an arbitration clause illusory in In re Zappos.com, Inc., Customer Data Security Breach Litigation, 893 F. Supp. 2d 1058 (D. Nev. 2012).

The FTC adds its own rule, running from its 2004 consent order in Gateway Learning Corp. through the Facebook (2011) and 1Health.io (2023) orders: a material change applied to data already collected requires affirmative express consent. Step 12 is built on these cases.

Formation decides whether the terms around the policy bind anyone. The Ninth Circuit's test in Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022) asks for reasonably conspicuous notice and an action that unambiguously manifests assent. Sign-in wraps passed in Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017), Oberstein v. Live Nation Entertainment, Inc., 60 F.4th 505 (9th Cir. 2023), Keebaugh v. Warner Bros. Entertainment Inc., 100 F.4th 1005 (9th Cir. 2024), and Fteja v. Facebook, Inc., 841 F. Supp. 2d 829 (S.D.N.Y. 2012). Courts found no assent where the terms sat behind links the user never had to see, in Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002) and Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014), and where the flow hid the terms or never tied the click to them, in Sgouros v. TransUnion Corp., 817 F.3d 1029 (7th Cir. 2016), Cullinane v. Uber Technologies, Inc., 893 F.3d 53 (1st Cir. 2018), Chabolla v. ClassPass Inc., 129 F.4th 1147 (9th Cir. 2025), and Godun v. JustAnswer LLC, 135 F.4th 699 (9th Cir. 2025). The sign-up screen and the change notice are therefore design work for lawyers, which is why they appear in Steps 8 and 12.

Contract doctrine and standing limit private suits, not regulators. Courts have often refused to treat broad policy statements as contracts, Dyer v. Northwest Airlines Corps., 334 F. Supp. 2d 1196 (D.N.D. 2004) and In re Northwest Airlines Privacy Litigation, No. 04-126 (D. Minn. June 6, 2004); have denied contract damages for lost privacy, In re JetBlue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299 (E.D.N.Y. 2005); have read incorporated policies by their definitions, Carlsen v. GameStop, Inc., 833 F.3d 903 (8th Cir. 2016), or as recitals rather than promises, Kuhns v. Scottrade, Inc., 868 F.3d 711 (8th Cir. 2017); and, in the Seventh Circuit, have held that a bare breach of contract is not an injury in fact, Dinerstein v. Google, LLC, 73 F.4th 502 (7th Cir. 2023).

Article III requires a concrete injury, Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), and session-replay plaintiffs have lost on that ground in Jones v. Bloomingdales.com, LLC, 124 F.4th 535 (8th Cir. 2024) and Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025). None of that binds the FTC, which still obtains orders and civil penalties after AMG Capital Management, LLC v. FTC, 593 U.S. 67 (2021), or a state attorney general. These are litigation defenses, not drafting strategies. Draft for the regulator, who needs no injured plaintiff.

Phase one: scope, applicable law, facts, and decisions

Step 1: Open the project, name the owners, and collect what already exists (days 1 to 5)

Name one accountable owner: the privacy lead, the general counsel, or for a small company the outside lawyer. That person will sign the verification table in Step 9, so pick someone with authority to make engineers answer questions. Then name the system owners, because the drafter's sources are people before they are documents.

Define scope in writing: every legal entity and brand, every domain, subdomain, app, and connected device, every offline channel (stores, call centers, events, mail), and every population whose data you hold (consumers, business contacts, your customers' end users, applicants, employees, children). Then collect the existing record: every prior version of the policy (from the content management system, old PDFs, and the Internet Archive), the terms of service, the cookie notice and banner configuration, app store labels and permission strings, help-center articles about data, the security or trust page, data processing agreements and the subprocessor list, email and SMS consent language, marketing claims about privacy, and any regulator correspondence or demand letters.

Decide on privilege at the start, not after the gap assessment says something alarming. If counsel commissions the assessment to give legal advice, communications with employees made to secure that advice are protected under Upjohn Co. v. United States, 449 U.S. 383 (1981), and the D.C. Circuit held in In re Kellogg Brown & Root, Inc., 756 F.3d 754 (D.C. Cir. 2014) that privilege applies when obtaining legal advice was one of the significant purposes of an internal inquiry, even if a compliance program also required it. The facts are never privileged, and the published policy obviously is not.

Keep the data map and vendor register as ordinary business records you can use, keep counsel's gap memo and risk ranking privileged, and if documents are produced later, ask for an order under Fed. R. Evid. 502(d) so a production does not become a waiver.

Output: a one-page charter (owner, scope, deadline, and who decides business questions) and a document inventory.

Step 2: Decide which laws apply, and write the answer down (week 1)

Write an applicability memo with one row per law: whether it applies, why, what document it requires, and who owns that document. Work through the questions in this order.

1. Where are the people? States and countries, judged from shipping addresses, account data, and traffic.
2. How many, and how much revenue? The CCPA applies to a for-profit business doing business in California that exceeds a revenue threshold (originally $25 million, now adjusted for inflation every two years), or that buys, sells, or shares the personal information of 100,000 or more consumers or households, or that derives half its revenue from selling or sharing it. Most other states use 100,000 residents, or 25,000 residents plus a share of revenue from selling data. Texas and Nebraska exempt small businesses by size standard instead, but still require consent before a small business sells sensitive data.
3. What kinds of data? Children's data, health and health-adjacent data, biometrics, precise geolocation, financial accounts, government identifiers, video viewing history, student records, and workforce data each pull in their own rules.
4. What is the company, legally? A financial institution under GLBA, a HIPAA covered entity or business associate, a school official, a telecom or cable operator, a data broker, or a service provider to other businesses.
5. How does it market? Calls and texts, commercial email, targeted advertising, data sales, or marketing co-ops.
6. Does it reach the EU or UK? Offering goods or services to people there, or monitoring their behavior, brings in the GDPR (Article 3(2)).
7. Does data leave the country? EU transfers need a mechanism, and the Justice Department's bulk sensitive data rule, 28 C.F.R. Part 202, has since April 2025 restricted transactions that give countries of concern access to bulk U.S. sensitive personal data.

Then make the first structural decision: how many documents.

Output: the applicability memo, which you will revisit at every annual review (Step 14). For the state-by-state map, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Step 3: Build the fact base (weeks 1 to 4)

Four artifacts make up the fact base. If they already exist, this step is a refresh; if they do not, this step is most of the project.

The data inventory. One row per category of personal information, with its source, collection point, purposes, systems, recipients by name, whether it is sold or shared, whether it is sensitive, and its retention period. A single row shows the level of detail you need:

The vendor register. Classify every vendor as a service provider or processor, a third party, or an affiliate. Under the CCPA, a vendor is a service provider only if a written contract imposes the restrictions the statute and regulations list (Cal. Civ. Code §§ 1798.100(d) and 1798.140(ag); Cal. Code Regs. tit. 11, § 7051); without those terms, handing data to the vendor can be a sale or sharing. An advertising platform that combines your data with data from other businesses for cross-context behavioral advertising cannot be your service provider for that purpose, whatever the contract says. For the contracting program behind the register, see Building a Vendor and Third-Party Risk Management Program.

The network capture. Ask marketing for a list of tags and you will get an incomplete list, because tags load other tags, agencies leave tags behind, and SDKs change what they send without telling anyone. Capture traffic instead: the site and apps in every consent state (before any choice, after accepting, after rejecting, and with Global Privacy Control turned on), logged in and out, on sensitive pages (search, health or financial content, checkout, account screens), and for apps through an intercepting proxy. The method is in Auditing Your Website Tracking Stack: A Practical Guide.

The retention schedule. A period or criterion for each category, the deletion job that enforces it, the backup roll-off period, and the legal-hold exception. California's notice at collection must state retention by category, so the schedule has to exist before Step 7 can be written. See Data Minimization and Avoiding the Over-Retention of Personal Information.

Add two short descriptions: the rights-request workflow (intake channels, identity verification, response clocks, appeals, authorized agents) and the security controls the company actually runs, taken from its written information security program. The CCPA's clock is 45 days, extendable once by another 45; most Virginia-model states use the same clock plus an appeal; the GDPR allows one month, extendable by two more. For the security side, see Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide.

How to run the interviews. Send a questionnaire in advance, then meet each system owner for 30 to 60 minutes. Ask what the system does, not what it is supposed to do; ask what changed in the past 12 months, because a California policy speaks about the preceding 12 months; and ask the question that finds the lawsuits: "What do we do with data that would surprise a customer?" Then check the answers against the capture. Engineers describe intended behavior. The capture shows actual behavior.

What people forget. Offline collection (store sign-ups, events, recorded calls), data bought or appended from enrichment vendors (a disclosed "source" under the CCPA and an Article 14 notice under the GDPR), inferences and audience segments, prompts and outputs in AI features, and data about people who never signed up, such as uploaded contacts and referral emails. In In re Yahoo Mail Litigation, 7 F. Supp. 3d 1016 (N.D. Cal. 2014), the people who wrote to Yahoo users had agreed to nothing, which is the whole problem with data about non-users.

Output: the data inventory, vendor register, capture report, retention schedule, and the two workflow descriptions. For a mid-market company, expect two to four weeks of part-time work across teams; the capture alone takes a technically capable person one to three days per property.

Step 4: Make the business decisions the policy will describe (weeks 4 to 5)

A policy describes decisions; it cannot make them. If marketing has not decided whether advertising pixels will run on logged-in pages, no drafter can write a true sentence about them. Hold one decision meeting, record the outcome in a dated decision log with an owner for each item, and draft only after the log is complete.

Two rules govern the meeting. First, write for what will actually happen, not for what someone hopes will happen; if the company cannot control a practice, describe it rather than promise it away. Second, remember the asymmetry: narrowing a policy later is easy, while broadening it triggers notice and sometimes consent under Step 12. The decision log has a second life as the trigger list for change control in Step 13, and as evidence of a deliberate process if the policy is ever challenged.

Phase two: architecture, drafting, notices, and consent

Step 5: Choose the architecture and the layers (week 5)

Decide which documents the project will produce before anyone writes a paragraph. The usual set is the full policy (the reference document), a summary layer at its top, a notice at each collection point, just-in-time notices for unexpected collection, a choices page, and the separate statutory documents identified in Step 2. Each layer must be accurate standing alone. Under the net-impression rule in Cyberspace.com, a summary that says "we don't sell your data" is misleading even if section 9 discloses "sharing" for advertising.

Publish the full policy as an HTML page at a stable URL, with a table of contents, an anchor for each section, the effective date at the top, and a link to prior versions. Never rename or move it casually: in In re Facebook Internet Tracking, the contract pointed to a "Privacy Policy" that had been renamed the "Data Use Policy," and the rename broke the incorporation.

Write it to the California standard, which is a sensible national standard: plain language without jargon, readable on a phone, available in every language the business uses for contracts and marketing, and accessible to people with disabilities, which in practice means WCAG 2.1 AA (Cal. Code Regs. tit. 11, § 7003). Accessibility is not only a privacy rule: the Ninth Circuit held in Robles v. Domino's Pizza, LLC, 913 F.3d 898 (9th Cir. 2019) that Title III of the ADA, 42 U.S.C. § 12182, reached a pizza chain's website and app because they connected customers to its restaurants. See Website and Mobile App Accessibility Under the ADA: WCAG, Litigation Risk, and Remediation.

The second architectural decision is whether the terms of service incorporate the policy.

Either way, keep the names and URLs stable, include a clause saying which document controls when a product-specific notice and the general policy differ (the gap that decided Calhoun; in Kuhns, a clause of exactly that kind told the court which of two privacy statements governed the plaintiff's account), and never use the policy as a statutory consent form. The formation rules are covered in Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration.

Step 6: Draft the full policy from the fact base (weeks 5 to 7)

Draft each section from a named artifact, and record the source of each factual sentence in a parallel review table as you go; that table becomes the verification tool in Step 9. The order that works:

1. Scope. Which entities, brands, sites, and apps the policy covers, and what it does not (data processed for business customers, workforce data covered by a separate notice).
2. Summary. The five to seven facts a customer most wants: what you collect, whether you sell or share it, sensitive data, choices, and how to reach you.
3. What we collect. By category, using the statutory categories with plain examples, and by source (from you, automatically, from others).
4. Why. Purposes tied to categories and, for GDPR readers, a legal basis for each purpose, as the transparency guidelines the European Data Protection Board adopted from the Article 29 Working Party (WP260 rev.01) expect. Delete "for other business purposes."
5. Who receives it. By category of recipient and purpose, with service providers separated from advertising partners. Name the significant recipients where that helps a reader understand; the FTC's cases punish surprise, not candor. Say how you respond to legal process and whether you notify users first, because litigants trying to unmask an anonymous user will test that promise; see Identifying an Anonymous Defendant Online: A Practical Guide.
6. Tracking and choices. The tools, what they collect, who receives it, how to opt out, and how opt-out preference signals are honored.
7. Sensitive data and children. Categories, purposes, consent or limit rights, and the age policy.
8. Retention. A period or the criteria, by category, matching the schedule.
9. Security. Controls, not guarantees.
10. Your rights. How to submit a request, how identity is verified, response times, appeals, and authorized agents.
11. State and international sections.
12. Changes. How notice will be given, and the promise not to apply material changes to existing data without consent.
13. Contact, effective date, and prior versions.

A few sentences show the voice. Use each only if it is true.

Sharing. "We disclose your browsing and purchase activity on our site to advertising partners, including Meta and Google, so they can show you our ads on other sites. California law calls this 'sharing.' You can opt out at Your Privacy Choices, and we treat a Global Privacy Control signal from your browser as an opt-out for that browser and, if you are signed in, for your account."

Retention. "We keep order records for seven years to meet tax and accounting requirements. We keep your marketing profile for three years after your last purchase and then delete it."

Security. "We encrypt account data in transit and at rest, limit employee access by role, and test our systems regularly. No system is perfectly secure, and we cannot promise that information will never be accessed without authorization."

Changes. "If we make a material change, we will tell you by email and in the app at least 30 days before it takes effect. We will not use information collected before the change in a materially different way unless you agree."

Then run two read-throughs. The skeptical-reader test: read each sentence as opposing counsel would, printed next to a network capture, and fix anything that reads as a guarantee ("never," "only," "anonymous," "industry-standard," "HIPAA compliant"). The definitions test: defined terms are enforced as written, which helped Google in Hammerling and the retailer in Carlsen, but a definition engineered to win a contract case is the kind of fine print the FTC treats as misleading. Define terms to inform, not to escape.

Step 7: Draft the notices at collection and the just-in-time notices (weeks 6 to 7)

Walk down the "collection point" column of the data inventory and assign a notice to every row.

California's notice at collection must state the categories of personal and sensitive personal information, the purposes, whether each category is sold or shared, the retention period for each, and links to the opt-out and the policy (Cal. Code Regs. tit. 11, § 7012). Just-in-time notices carry the weight for unexpected collection, as FTC staff recommended for location and other sensitive data in Mobile Privacy Disclosures: Building Trust Through Transparency (Feb. 2013). The statutory consents (a BIPA written release, TCPA prior express written consent, VPPA consent, verifiable parental consent, a HIPAA authorization) are not notices at all; they are built in Step 8.

Step 8: Build the consent and choice mechanics (weeks 6 to 8, with engineering)

Consent is where legal drafting turns into product engineering, and where most of the recent enforcement has landed. Build in this order.

1. The banner and the choices page. Equal-weight "Accept" and "Reject" buttons, region logic (opt-in where the law requires it, opt-out elsewhere), separate choices for analytics, advertising, and sensitive uses, and a persistent link to change a choice. Detect Global Privacy Control and apply it without asking the user to confirm, and attach the opt-out to the account when the user is signed in.
2. The gate. Tags, session replay, and chat recording that require consent must not fire until the choice is made. A banner that does not control the tags is evidence against you.
3. The opt-in flows. Sensitive data in most states; consumer health data in Washington (consent to collect, separate consent to share, and a signed authorization to sell); children's data (verifiable parental consent under 16 C.F.R. § 312.5, with separate consent for most third-party disclosures since the 2025 amendments); biometrics (a written release under 740 ILCS 14/15(b)); marketing texts and calls (prior express written consent under 47 C.F.R. § 64.1200(f)(9), disclosed as not a condition of purchase, with its scope measured by the purpose for which the number was given under Van Patten); video viewing data (consent "distinct and separate" from other terms under 18 U.S.C. § 2710(b)(2)(B)); and loyalty enrollment. E-SIGN, 15 U.S.C. § 7001, lets each of these be electronic; see Electronic Signatures and Records Under ESIGN and UETA: What Actually Binds, and for the text-message consent in particular, The TCPA and Text Message Marketing: Consent, Revocation, and Class Action Exposure.
4. The dark-pattern review. The California regulations require symmetry in choice and forbid confusing language and guilt-tripping (Cal. Code Regs. tit. 11, § 7004). Under the GDPR, a pre-checked box is not consent (the Court of Justice's 2019 Planet49 decision), and withdrawal must be as easy as consent (Article 7(3)). The FTC applies the same ideas under Section 5 and catalogued the designs it challenges in the staff report Bringing Dark Patterns to Light (Sept. 2022); the European Data Protection Board's Guidelines 05/2020 on consent are the EU equivalent; and the Restore Online Shoppers' Confidence Act, 15 U.S.C. § 8403, governs subscription flows. See Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule.
5. The consent record. For every choice, log the timestamp, user or device identifier, jurisdiction, notice version, the version of the screen shown, the choice, the method, and every later change. California requires records of consumer requests and responses for 24 months (Cal. Code Regs. tit. 11, § 7101), but keep consent records as long as you rely on the consent plus the limitations period: five years for every BIPA claim under Tims v. Black Horse Carriers, Inc., 2023 IL 127801, and two years under the Wiretap Act's civil remedy, 18 U.S.C. § 2520(e).
6. The test. Run a matrix of jurisdictions, consent states, browsers, devices, and signed-in states, then a second network capture to prove that "Reject" and Global Privacy Control actually stop the tags.

Phase three: verify, align, publish, and give notice

Step 9: Verify every sentence before launch (week 8)

Turn the review table from Step 6 into a sign-off document with one row per factual sentence.

A sentence without a source gets rewritten or deleted, or the practice changes to match it. Pay special attention to objective claims ("encrypted," "anonymized," "deleted within 30 days," "only to provide the service"), because the FTC requires a reasonable basis for objective claims before they are made, as POM Wonderful applied the rule. Then run the live tests: a fresh capture if the consent build changed anything; an access and a deletion request submitted as a test user and followed through to the vendors; an unsubscribe test against CAN-SPAM's ten-business-day rule, 15 U.S.C. § 7704(a)(4) (see The CAN-SPAM Act: A Comprehensive Guide for Businesses and Marketers); an in-app account deletion; and a sample of records past their retention period. Finish with a plain-language edit, an accessibility check, and a translation review by a fluent reader who compares meaning rather than words. Each owner signs the rows for their systems.

Step 10: Align every other public statement (week 8)

The policy is rarely the most specific thing a company says about data, and the most specific statement is the one that gets quoted. Calhoun turned on a product notice and In re Facebook Internet Tracking on a help-center answer. Before launch, collect and conform:

• help-center articles, FAQs, and support macros;
• the Apple privacy label, the Google Play Data safety form, and every permission purpose string;
• the cookie notice and banner text;
• the security or trust page, the data processing agreement, and the subprocessor list;
• marketing claims ("we never sell your data" banners), sales decks, and answers in security questionnaires;
• email footers, SMS keyword replies, and chatbot scripts, including any AI support assistant that answers privacy questions, because it speaks for the company.

Check the contracts too. Analytics and advertising platforms commonly require customers to disclose their tools and obtain any legally required consent, and both app stores require a policy link in the listing and in the app and require apps that offer account creation to offer account deletion. Give one person ownership of a public-statements register so the next change reaches every surface at once. The mobile specifics are in Legal Issues for Mobile Applications: Privacy.

Step 11: Approve, publish, and archive (week 9)

Approve. The owner signs the verification table, counsel approves the text, and management is briefed on the business decisions it embodies. A company under an FTC order adds whatever certification the order requires.

Publish where the statutes say. CalOPPA requires a website operator to "conspicuously post" the policy, and the usual way to do it is a homepage link containing the word "privacy" that stands out through capital letters, larger or contrasting type, or symbols that set it off, one of several options the statute lists (Cal. Bus. & Prof. Code § 22577(b)). The CCPA regulations require a conspicuous link using the word "privacy" on the website homepage or, for an app, its download or landing page, and allow a link in the app's settings menu (Cal. Code Regs. tit. 11, § 7011(d)). In practice, link the policy from every page footer, every sign-up and checkout screen, the app store listings, the app's settings, and every marketing email, and keep printed copies for physical locations. Put the effective date at the top.

Archive the moment it goes live. Save HTML and PDF copies with a cryptographic hash, screenshots of every banner, form, and notice at collection the version governs, the list of products and sites it covered, and the approval record. The Internet Archive is a useful backstop but not your archive.

These records are what you will use to prove the policy: by a witness with knowledge or distinctive characteristics under Fed. R. Evid. 901, by certification of electronic records under Fed. R. Evid. 902(13) and (14), and as business records under Fed. R. Evid. 803(6) if you keep them in the regular course. Courts disagree about judicial notice of archived web pages under Fed. R. Evid. 201, which is another reason not to rely on someone else's archive. See Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.

Step 12: Give notice of changes, and get consent when the rule requires it (week 9, and every change after)

Classify the change. Clarifications, reorganization, new contact details, and a new vendor of a kind already disclosed are usually not material. A new category of data, a new purpose, a new category of recipient, starting to sell or share, a new use of sensitive data, longer retention, weaker rights, and training AI models on existing data are material.

Prospective material changes need actual notice before they take effect. Use channels users actually see: an email to account holders, an in-app notice or a banner at the next sign-in, and a dated summary at the top of the policy. Thirty days of lead time is common and defensible. Colorado's rules separately require notice of material changes to a privacy notice and fresh consent before processing for a secondary purpose. If the terms of service change at the same time, ask for an affirmative re-acceptance at the next sign-in rather than relying on "continued use means acceptance," which is the approach Douglas, Stover, and Schnabel each found wanting.

Retroactive material changes need affirmative express consent. Applying a new practice to data collected under the old policy requires opt-in consent under the FTC's Gateway Learning line, and in February 2024 FTC staff warned that quietly changing terms to permit AI training on previously collected data could be unfair or deceptive. If people do not consent, segregate the legacy data by the policy version under which it was collected and keep using it only on the old terms. That is why Steps 3 and 8 record a notice version for each data set and each consent.

Follow the sector procedures. A financial institution must send a revised notice and a new opportunity to opt out before sharing in a way its earlier notice did not describe (Regulation P, 12 C.F.R. Part 1016, and 16 C.F.R. Part 313). A HIPAA covered entity must revise its Notice of Privacy Practices and generally may not implement a material change before the revised notice takes effect (45 C.F.R. § 164.520(b)(3)); see HIPAA Privacy and Security Compliance for Covered Entities and Business Associates. A COPPA operator needs new parental consent for a material change in collection, use, or disclosure. The GDPR requires information before data is processed for a new purpose (Article 13(3)).

Write the notice like a notice. Say what is changing, when, and what choices the reader has, and link to a summary or redline. Keep it out of marketing emails, and use a subject line that says what it is ("Changes to how we use your purchase history") rather than "We've updated our policies." Keep the send logs, the banner impression logs, and the consent records: they are the proof that notice was given.

Phase four: keeping the policy true

Step 13: Install change control (ongoing)

Policies decay because marketing adds tags, engineering adds SDKs, and product finds new uses for old data, usually without telling legal. Change control puts a gate in each of those paths.

• Product. The requirements template asks one question: does this change what we collect, why we collect it, who receives it, or how long we keep it? A yes routes the feature to the policy owner.
• Procurement. No vendor that touches personal data is signed until it is classified in the vendor register and its contract carries the right terms.
• The tag manager. Publishing rights are limited, each publish needs a ticket, container versions are exported monthly, and an automated scan flags any new third-party domain the site contacts.
• The trigger list. The decision log from Step 4, plus new jurisdictions, acquisitions, legal changes, incidents, and any demand letter or regulator inquiry.

A triggered change runs a miniature version of Steps 3 through 12: update the inventory row, make the decision, draft, verify, align, publish, and notify. A routine change takes days. A material change takes 30 to 45 days because of the notice period, which is why product teams should hear about the gate before they promise a launch date.

Step 14: Run the annual review and accuracy audit (every 12 months, and after any trigger)

California requires the policy to be updated at least once every 12 months (Cal. Civ. Code § 1798.130(a)(5)), and changing the "last updated" date without reviewing anything is its own small misrepresentation. The audit compares the policy with six sources of truth: a refreshed data inventory; a vendor register reconciled against accounts payable (a vendor you pay but never classified is the most common finding); a fresh capture in every consent state; the consent platform's behavior, including Global Privacy Control; a sample of expired records to confirm deletion; and every entry in the public-statements register.

Pair it with a legal refresh. New state laws and effective dates go into the applicability memo, as do rule changes such as California's 2025 regulations on risk assessments, cybersecurity audits, and automated decisionmaking (effective January 1, 2026, with obligations phasing in afterward) and the COPPA amendments' April 22, 2026 compliance date. A business that buys, receives, sells, or shares the personal information of 10 million or more consumers in a calendar year must compile request metrics and post them in or through its policy by July 1 (Cal. Code Regs. tit. 11, § 7102). Sector items recur on the same calendar: the GLBA annual notice unless the exception in 15 U.S.C. § 6803(f) applies, the HIPAA notice posting, the COPPA retention policy, and FERPA's annual notification for schools. The output is an audit memo, a redline, a change-log entry, and a one-page summary for management.

Step 15: Keep the records that prove what you said and when (ongoing)

Keep every policy version with its effective date, redline, approvals, and screenshots; the consent records; change notices and their send logs; rights-request records (at least 24 months in California); tag manager and consent platform configuration histories; capture reports; and audit memos. Keep them at least as long as the longest limitations period you face, and longer for data still in use.

When a demand letter or regulator inquiry arrives, the litigation hold must reach the tag manager history, the consent platform configuration, the policy archive, and the consent logs that same day, because those systems overwrite themselves. They are also the first things the other side will ask for under Fed. R. Civ. P. 26 and Fed. R. Civ. P. 34, often through a Fed. R. Civ. P. 30(b)(6) deposition on data flows, and losing them invites measures under Fed. R. Civ. P. 37(e).

Strategy for each side when the policy is tested

For the company that receives a demand letter or complaint

1. Preserve today, as Step 15 describes.
2. Route the investigation through counsel so the analysis is privileged under Upjohn and Kellogg Brown & Root, while accepting that the underlying facts are discoverable.
3. Reconstruct the relevant dates: which policy version, which banner, which tags, and which consent records applied to the named plaintiffs. The archive from Step 11 either wins this or loses it.
4. Fix forward, never backward. Change the practice and the policy prospectively, and never backdate anything. A rewrite is not consent to past conduct. Evidence of later remedial measures is not admissible to prove culpable conduct under Fed. R. Evid. 407, though it can come in for other purposes, so fixing promptly is usually the right call.
5. Work the defenses in order: arbitration and formation (Berman, Meyer, Oberstein); standing (TransUnion, Jones v. Bloomingdales.com, Popa v. Microsoft), remembering that a removed case that fails Article III goes back to state court, as in Popa v. Harriet Carter Gifts, Inc., No. 25-1760 (3d Cir. Mar. 26, 2026); consent, which is your burden and your records; the contract limits in Dyer, Kuhns, and Dinerstein; and the merits, through a motion under Fed. R. Civ. P. 12. Class certification under Fed. R. Civ. P. 23 often turns on whether every class member saw the same notice version, so a good archive helps both sides.
6. Check notification duties. If health data reached advertising platforms, the Health Breach Notification Rule or a state breach statute may require notice regardless of the lawsuit.

For pleading consent and the other defenses, see Answering a Federal Complaint: Denials, Affirmative Defenses, Counterclaims, and Judgment on the Pleadings.

For the company that receives a regulator's inquiry

The FTC investigates through civil investigative demands under 15 U.S.C. § 57b-1. Its rules require the recipient to meet and confer with staff within 14 days after receipt and to file any petition to limit or quash within 20 days after service (16 C.F.R. §§ 2.7(k) and 2.10(a)(1)). State attorneys general and the California Privacy Protection Agency have their own investigative powers; several state statutes give a right to cure before enforcement, some permanently and some only for an initial period, and California's does not.

Treat every narrative response as a representation to the government and verify it the way Step 9 verifies the policy. Expect remedies aimed at process rather than words: a privacy program with outside assessments, retention schedules, deletion of data and of models trained on it, and bans on particular uses. The Eleventh Circuit's decision in LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018) requires those orders to command specific acts, which gives respondents something to negotiate over. In unfairness cases, the FTC need not point to any statement at all: in FTC v. Kochava, Inc., No. 2:22-cv-00377-BLW (D. Idaho Feb. 3, 2024), the court denied a data broker's motion to dismiss, holding that the FTC had plausibly alleged substantial injury from the sale of location and other data revealing sensitive facts, and that an invasion of privacy can itself be the injury.

For the plaintiff, consumer, or advocate reading for inconsistencies

• Pull every version from the Internet Archive, the company's prior-versions page, app store label histories, and cached help-center pages.
• Capture the traffic on the pages that matter, signed in and out, with and without Global Privacy Control.
• Exercise the rights. An access request shows what the company actually holds and whom it says it disclosed data to.
• Read beyond the policy: help-center answers, labels, banners, and chatbot replies.
• Pick theories that survive. Intrusion and statutory claims built on a specific promise (Nickelodeon, Calhoun) do better than contract claims, which face damages problems (JetBlue) and, in the Seventh Circuit, standing problems (Dinerstein). Fraud-based claims need reliance, and in In re iPhone Application Litigation, 6 F. Supp. 3d 1004 (N.D. Cal. 2013) summary judgment followed because no named plaintiff had read the statements at issue.
• Check formation before filing. If the arbitration flow fails the Berman test, as in Chabolla and Godun, the case may stay in court.
• Without a lawsuit, turn on Global Privacy Control, use the opt-out links, and complain to the FTC, the state attorney general, and in California the California Privacy Protection Agency.

For the acquirer in diligence

Ask for every version of every policy and notice for the full lookback period, the data inventory, the vendor register, consent records for the data being bought (especially sensitive data and data used to train models), a fresh capture, regulator correspondence and demand letters, rights-request metrics, and the policy's corporate-transaction clause.

The red flags are a missing archive, sensitive data without consent records, models trained on data collected under narrower promises (the disgorgement risk), and policies that promise never to transfer data. Paper the findings with representations of compliance with posted policies and no retroactive changes without consent, a special indemnity for known tracking exposure, and a post-closing plan that honors the target's promises for the target's data, as the FTC insisted when Facebook acquired WhatsApp in 2014. The deal paper is covered in Representations, Warranties, and Indemnification in Acquisition Agreements: Where the Money Actually Moves, and the request list in IP Due Diligence Checklist for Mergers and Acquisitions: A Practical Checklist.

In bankruptcy, 11 U.S.C. § 363(b)(1) limits the sale of "personally identifiable information," as defined in 11 U.S.C. § 101(41A), to what the debtor's policy allows unless the court approves after review by an ombudsman appointed under 11 U.S.C. § 332.

Timeline and costs at a glance

Outside legal fees track the size of the fact-finding job: roughly $1,500 to $5,000 for a simple single-site business, $10,000 to $40,000 for a mid-market company with notices at collection and multi-state sections, and $50,000 to $250,000 or more for an enterprise program build in its first year. A consent management platform runs from free tiers to six figures a year, and an annual accuracy audit with outside help typically costs $5,000 to $30,000. The internal cost is mostly engineering time for captures and consent work, plus translation and accessibility review. Against that sits the exposure the companion article quantifies: civil penalties for violating FTC rules and orders, per-violation CCPA penalties, and statutory damages under the wiretap, video privacy, and biometric statutes that multiply by class size.

Worked example: Harbor & Pine rebuilds its policy in ten weeks

Harbor & Pine, the online home-goods retailer from the companion article, is launching Harbor Rewards: points, birthday discounts, and offers from partner brands, delivered through a new app. Its general counsel, Dana Ortiz, owns the project.

Weeks 1 and 2 (Steps 1 and 2). Scope covers the website, the new app, two showrooms, and a call center. The applicability memo finds the CCPA (revenue well above the threshold), eleven other state laws with customers in each, CAN-SPAM for email, and the TCPA for a planned text program. There is no GLBA exposure because the store credit card is issued by a partner bank, which sends its own notices, and no COPPA exposure because nothing is directed to children and the app requires adult accounts. Dana engages outside counsel to run a privileged gap assessment.

Weeks 2 to 4 (Step 3). The capture finds 27 third-party domains on the checkout page, including a session-replay script recording the address form and a Pinterest tag that an agency installed in 2022 and nobody remembers. The vendor register lists 63 vendors; 11 lack service-provider terms. There is no retention period for marketing profiles.

Week 5 (Step 4). The decision meeting keeps Meta and Google advertising (California "sharing") with an opt-out and Global Privacy Control, removes the Pinterest tag, moves session replay behind consent with masked fields, sets a three-year retention period for marketing profiles, and decides that partner brands will receive data only about members who opt in to partner offers, with a second, express opt-in required before any purchase history from before enrollment is shared. Text messages will require their own consent.

Weeks 5 to 7 (Steps 5 to 8). The team produces a rewritten policy; notices at collection for checkout, account creation, and app onboarding; a notice of financial incentive with a good-faith estimate of the value of members' data (about $14 a year, computed from the incremental margin members generate, one of the methods the California regulations accept); program terms; an unchecked text-message consent box stating that consent is not a condition of purchase; and a banner with equal "Accept" and "Reject" buttons that applies Global Privacy Control to signed-in accounts.

Week 8 (Steps 9 and 10). Verification catches two false sentences. The draft said "when you delete your account, we delete all of your information," but the email platform keeps a suppression list so that unsubscribed addresses are never mailed again; the sentence now says so. The draft app store label said purchase history was "not linked to you," which the loyalty program makes untrue; the label is corrected before submission. Alignment removes a help-center answer that said "we never share your information with advertisers."

Week 9 (Steps 11 and 12). The policy goes live and is archived with screenshots of every collection screen. Harbor & Pine emails 410,000 account holders 30 days before partner offers begin, explaining the change in plain terms, and shows an in-app notice. Because sending pre-enrollment purchase histories to partners would be a retroactive material change, that history goes to partners only for members who give the second opt-in; everyone else's stays under the old terms, tagged by policy version.

Week 10 (Steps 13 to 15). Publishing rights in the tag manager are limited to two people, a weekly scan watches for new domains, the annual audit goes on the calendar, and the records program starts. Outside fees come to about $32,000, the consent platform upgrade to $9,000 a year, and internal engineering to about twelve person-days.

Seven months later, a demand letter alleges that session replay recorded checkout visitors without consent. The archive and the tag manager history show exactly when replay moved behind the consent choice, so the dispute shrinks to a defined window before the rebuild instead of an open-ended fishing expedition. That is what the records were for.

Special situations

Common mistakes

1. Starting from a template or a competitor's policy. It describes someone else's systems.
2. Asking for a tag list instead of capturing traffic. The list is always incomplete.
3. Drafting before the business decisions are made. The policy then describes a debate, not a practice.
4. Publishing before testing that "Reject" and Global Privacy Control stop the tags. A decorative banner is evidence for the other side.
5. Changing the "last updated" date without reviewing anything. The date is a representation too.
6. Sending "We've updated our policies" for a retroactive material change. Notice is not consent.
7. Renaming or moving the policy without updating every reference. In re Facebook Internet Tracking turned on exactly that.
8. Forgetting the help center, labels, chatbots, and sales answers. The most specific statement controls.
9. Keeping no archive of your own. Popa shows what happens when a company cannot produce its old policy.
10. Using the policy as a TCPA, VPPA, BIPA, or HIPAA consent. Each needs its own instrument.
11. Leaving the project without an owner after launch. The policy starts decaying the next morning.

Frequently asked questions

How long does it take to draft a privacy policy properly? Two to three weeks for a simple single-site business, eight to twelve weeks for a mid-market company with an app and multi-state customers, and one to two quarters for an enterprise program. Add 30 days whenever a material change requires advance notice.

Can we use a generator or a template? For structure, yes. For facts, no. A template cannot know what your checkout page sends to whom, and the FTC does not care where a false sentence came from.

Do we have to notify users of every change? No. Log every change, but only material changes need advance notice, and only material changes applied to data you already hold need affirmative express consent. Sector rules (GLBA, HIPAA, COPPA) add their own procedures.

What makes a change material? Anything that would matter to a reasonable person deciding whether to use the service or share the data: new categories of data, new purposes, new kinds of recipients, starting to sell or share, new uses of sensitive data, longer retention, or weaker rights.

Should our terms of service incorporate the privacy policy? It is a trade-off. Incorporation strengthens consent and arbitration arguments but opens the door to contract claims and makes renames dangerous. Whichever you choose, keep the names and URLs stable and say which document controls when two of them disagree.

We just learned our policy has been wrong for a year. What now? Fix or stop the practice first, preserve the evidence, and bring in counsel. Then assess whether the facts trigger notice duties (the Health Breach Notification Rule or a state breach statute), correct the policy prospectively without backdating anything, and decide whether continued use of the affected data needs fresh consent.

As a consumer, how can I tell whether a company follows its own policy? Read the specific statements (settings, help pages, app labels) rather than the general policy, turn on Global Privacy Control, submit an access request, and complain to the FTC or your state attorney general if the answers do not match the promises.

Practical takeaways

• Do the work in order: scope, law, facts, decisions, and only then words.
• Build the policy from the data inventory, the vendor register, a live network capture, and the retention schedule.
• Make the business decisions in a dated log; the policy describes them and change control watches them.
• Tie every factual sentence to a source of truth and a named owner before launch.
• Make tracking, replay, and recording wait for a real choice, and honor Global Privacy Control.
• Align the help center, store labels, banners, chatbots, and sales answers with the policy.
• Give actual advance notice of material changes, and get affirmative express consent before applying them to data you already hold.
• Archive every version with screenshots, keep consent records that show what each person saw, and audit at least every 12 months.

For a line-by-line review tool, use the Privacy Policy Drafting and Review Checklist: A Practical Checklist. For model clauses, consent flows, and change-management records, use the Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: the legal analysis behind every step in this guide.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the state laws that set the policy's contents.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: the litigation that tests policies against network traffic.
• Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration: formation rules for the terms that surround the policy.
• Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule: the design rules behind consent flows.
• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: children's notices and parental consent.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the security duties behind the security paragraph.
• Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court: proving what a page said on a given day.
• Answering a Federal Complaint: Denials, Affirmative Defenses, Counterclaims, and Judgment on the Pleadings: pleading consent and the other defenses.
• Representations, Warranties, and Indemnification in Acquisition Agreements: Where the Money Actually Moves: paper for privacy findings in a deal.

Related Guides

• Auditing Your Website Tracking Stack: A Practical Guide: how to run the network capture in Step 3.
• Developing a Privacy Compliance Program: the program a policy sits inside.
• Data Minimization and Avoiding the Over-Retention of Personal Information: building the retention schedule.
• Building a Cybersecurity Compliance Program That Satisfies Regulators: A Practical Guide: the security program the policy describes.
• Legal Issues for Mobile Applications: Privacy: app permissions, SDKs, and store requirements.
• Building a Vendor and Third-Party Risk Management Program: the contracting program behind the vendor register.
• Employee Monitoring and Workplace Privacy: A Practical Guide: workforce notices and monitoring.
• Identifying an Anonymous Defendant Online: A Practical Guide: why legal-process disclosures matter.

Related Checklists

• Privacy Policy Drafting and Review Checklist: A Practical Checklist: the companion review checklist.
• Website Tracking Compliance Checklist: A Practical Checklist: phase-by-phase tracking review.
• Data Subject Rights Request Handling Checklist: A Practical Checklist: making the rights section true.
• COPPA Children's Privacy Compliance Checklist: A Practical Checklist: children's privacy compliance.
• Website Terms of Service Review Checklist: A Practical Checklist: reviewing the terms that point to the policy.
• IP Due Diligence Checklist for Mergers and Acquisitions: A Practical Checklist: diligence requests for data assets.

Related Toolkits

• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: model clauses, consent language, and change records.
• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventories and consent logs.
• Privacy and Data Protection Toolkit: Building and Running a Privacy Program: program documents that support the policy.
• Cybersecurity Compliance Toolkit: Written Information Security Programs, Risk Assessments, and Incident Disclosure Memos: the written information security program and related records.
• Consumer Marketing Compliance Toolkit: TCPA, CAN-SPAM, Auto-Renewal, and Endorsements: consent and opt-out tools for marketing messages.