Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records

Every privacy dispute eventually asks two questions the company should be able to answer in an afternoon: what did we tell this person, and what did this person agree to? Most companies need weeks, and some never find out, because the policy was edited in place, the banner copy lived in a vendor dashboard, and the consent log stored a single yes-or-no flag. The templates below are built so that the answers exist before anyone asks.

The short answer

• Templates supply structure; your records supply the facts. Every bracket in these templates must be filled from the data map, the vendor contracts, a network capture, or the retention schedule. A template filled with someone else's facts is a false statement waiting to be quoted back under Section 5 of the FTC Act, 15 U.S.C. § 45.
• Notices come in layers, and each layer must be true on its own: the full policy, the summary, the notice at collection, just-in-time notices, and the cookie banner.
• Consent flows must be specific, symmetrical, timed before the processing, recorded, and revocable. Statutory consents (consumer health data, biometrics, marketing texts, video viewing, children's data) need their own instruments; a privacy policy cannot stand in for any of them.
• Change management is the part companies skip and regulators enforce. Prospective material changes need real notice; applying a material change to data already collected needs affirmative consent; and every version needs a log entry, an archive copy, and screenshots.

How to use this toolkit

• Conventions. Text in [brackets] is to be completed; [Option A / Option B] means choose one; and a note in parentheses inside a template (for example, "Unchecked by default") is an instruction to whoever builds the screen, not text to publish. Delete every sentence that is not true for your business rather than leaving it in "just in case."
• Structure. Each template opens with its purpose, its owner, and when to use it, and closes with drafting commentary that ties the language to the governing law.
• Running examples. The filled-in samples use the three companies from the companion article: Stride Collective, a fitness app; Ledgerline, a B2B invoicing platform; and Harbor & Pine, an online home-goods retailer launching a loyalty program called Harbor Rewards.
• Companions. For the law, see Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC. For the step-by-step drafting and maintenance process, see Drafting and Maintaining a Privacy Policy: A Practical Guide. To review a finished draft line by line, use Privacy Policy Drafting and Review Checklist: A Practical Checklist.

Template 1: Master privacy policy skeleton

Purpose: the full reference policy for websites and apps. Owner: privacy counsel, with a named fact owner for each section. When to use: a new policy, or a rebuild of one that has drifted from practice.

[COMPANY] PRIVACY POLICY
Effective date: [date]   Last updated: [date]   Version: [number]
Previous versions: [link to archive page]

1. WHO WE ARE AND WHAT THIS POLICY COVERS
   This policy explains how [legal entity] ("we") collects, uses, and
   discloses personal information when you use [websites, apps, stores,
   devices]. It does not cover [information we process for business
   customers under their instructions; our employees and job applicants,
   who receive a separate notice; third-party sites we link to].

2. PRIVACY AT A GLANCE
   [Template 2]

3. INFORMATION WE COLLECT
   3.1 Information you give us: [account details, orders, messages]
   3.2 Information collected automatically: [device and browser data,
       IP address, approximate location derived from IP address, pages
       viewed, clicks] through [cookies, pixels, SDKs, server logs]
   3.3 Information from other sources: [payment processors, social
       login providers, advertising partners, data providers]
   3.4 Inferences we create: [interest segments, fraud scores]
   [Template 3 table]

4. HOW WE USE INFORMATION
   [Each purpose in one plain sentence]
   [AI and model training: which data, which models, how to opt out]
   [EEA and UK users: the legal basis for each purpose, section 12]

5. HOW WE DISCLOSE INFORMATION
   5.1 Service providers that act only on our instructions: [categories]
   5.2 Advertising and analytics partners: [categories; whether they may
       use data for their own purposes]
   5.3 [Affiliates; business partners you ask us to share with]
   5.4 Legal process and safety: [standard applied; whether we notify
       you first and when we do not]
   5.5 Corporate transactions: [merger, acquisition, financing,
       bankruptcy; the buyer will be bound by this policy for data
       collected under it]
   Sale and sharing: We do not sell personal information for money.
   We [share / do not share] personal information with advertising
   partners for targeted advertising, which California law calls
   "sharing." [Opt-out link]

6. COOKIES, PIXELS, SDKs, AND YOUR CHOICES
   [Categories; recipients; how to change preferences; how we honor
   Global Privacy Control; our separate Do Not Track answer]

7. SENSITIVE INFORMATION
   [Categories; purposes; consent or right to limit; link to the
   consumer health data policy if one is required]

8. CHILDREN AND TEENS
   [Not directed to children under 13, or link to the children's notice;
   practices for teens]

9. HOW LONG WE KEEP INFORMATION
   [Template 3 retention column]

10. HOW WE PROTECT INFORMATION
   [Specific controls; no guarantees]

11. YOUR RIGHTS AND HOW TO USE THEM
   [Rights; request methods; verification; authorized agents; appeals;
   response times]

12. STATE AND INTERNATIONAL DISCLOSURES
   [California; other states; EEA and UK]

13. CHANGES TO THIS POLICY
   [Template 10 commitments]

14. CONTACT US
   [Email; toll-free number; postal address; privacy officer or data
   protection officer; EU or UK representative]

Drafting commentary.

• Keep document and section names stable. In In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), the terms of service pointed to a "Privacy Policy" that had been renamed the "Data Use Policy," and the renamed document was held not incorporated. If you must rename, update every cross-reference in the same release.
• Build section 5 from the vendor classification, not from memory. The sale-and-sharing sentence is the one most often false. California's "sharing" reaches disclosure for cross-context behavioral advertising whether or not money changes hands.
• Write section 5.4 knowing litigants will test it. A promise to notify users before responding to legal process becomes an issue whenever someone tries to unmask an anonymous user; see Identifying an Anonymous Defendant Online: A Practical Guide.
• Section 5.5 is a promise the buyer inherits. In bankruptcy, 11 U.S.C. § 363(b)(1) restricts sales of personal information that would violate the policy in effect at filing.
• Section 10 describes controls, not outcomes. The FTC's deception count in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) quoted the hotel company's policy promises of "industry standard practices" and "commercially reasonable efforts" to protect card data.
• Section 13 is a promise about process. Posting a revision does not bind existing users who were never told, Douglas v. U.S. District Court, 495 F.3d 1062 (9th Cir. 2007).
• The version number and the "previous versions" link create the archive trail that Templates 13 and 16 rely on.

Template 2: Privacy at a glance (summary layer)

Purpose: the first layer most readers will see. Owner: privacy counsel with product marketing. When to use: at the top of the policy and, in shortened form, in app onboarding.

Drafting commentary.

• Each answer must be true standing alone. Regulators judge the net impression, and a qualification buried in section 9 does not cure a misleading summary: FTC v. Cyberspace.com LLC, 453 F.3d 1196 (9th Cir. 2006). Implied claims count as much as express ones: Kraft, Inc. v. FTC, 970 F.2d 311 (7th Cir. 1992).
• Answer yes when the answer is yes. "We may share certain information with trusted partners" reads as evasion to consumers and as an admission to plaintiffs.
• The AI row forces a decision. If the honest answer is "not yet," write "No," and route any future change through Templates 11 and 12.
• Keep the summary short enough to read on a phone and update it with every version; it is where the FTC's staff and the plaintiffs' experts start reading.

Template 3: Category disclosure matrix

Purpose: a single table that feeds the policy, the notice at collection, and California's 12-month disclosures. Owner: the privacy lead, filled from the data map and the vendor classification. When to use: every annual update and every time a data category, recipient, or retention period changes. The sample rows are for Harbor & Pine.

Drafting commentary.

• Use the statutory category names where a law requires them (California's appear in the definition of personal information, Cal. Civ. Code § 1798.140(v)), but fill the "Examples" column with the actual data elements.
• Every "No" in the sold-or-shared column must survive a capture. If an advertising pixel fires on the page where a category is collected, the honest answer is probably "Shared."
• Every retention entry must correspond to a deletion job. The CCPA requires a period, or the criteria used to set it, for each category at the point of collection (Cal. Civ. Code § 1798.100(a)(3)). "As long as necessary" is neither. See Data Minimization and Avoiding the Over-Retention of Personal Information.
• Account credentials are sensitive personal information in California, but using them only to log the user in is a permitted purpose that does not trigger the right to limit.

Template 4: Notice at collection (online, offline, and by phone)

Purpose: the short notice California requires at or before the point of collection, which also serves as good practice everywhere. Owner: the product or form owner, with privacy counsel. When to use: on every form, sign-up flow, and checkout page; at points of sale; and on calls where personal information is collected.

ONLINE (placed beside the submit button)
We collect the information in this form ([name, email, phone]) to
[create your account, fulfill orders, and send order updates]. We
[do not sell it. We share your email address, in hashed form, with
advertising partners for targeted advertising; you can opt out at
Your Privacy Choices]. We keep it [while your account is open and for
30 days after you close it]. Full details: [link that opens directly
at the "Notice at Collection" section of the Privacy Policy].

POINT OF SALE (sign at the register or printed on the form)
When you give us your phone number or email at checkout, we use it to
[look up your Harbor Rewards account and email your receipt]. We keep
it [while your membership is active and for 30 days after]. We [do not
sell it or share it for advertising]. Read our full notice at
[short URL] or scan the code.

TELEPHONE (read before collecting)
"Before I take your details: we'll use your name, phone number, and
order information to [process this order and contact you about it].
[We don't sell it.] You can hear or read our full privacy notice at
[short URL]. Would you like me to continue?"

Drafting commentary.

• Content. The notice lists the categories of personal and sensitive personal information, the purposes, whether each category is sold or shared, how long each is kept, a link to the opt-out notice if one applies, and a link to the policy (Cal. Code Regs. tit. 11, § 7012). Template 3 supplies all of it.
• Placement. The online link must open at the section that contains those elements; sending the reader to the top of a 6,000-word policy does not count.
• Pixels on the form page are collection too. If an advertising partner controls collection on the page, either include its practices in your notice or confirm it gives its own; the capture tells you which vendors are there.
• Offline and phone channels are covered. The CCPA applies to personal information collected offline, so a loyalty sign-up at the register needs the same notice as the website.
• Employees, applicants, and contractors need their own notices at collection; see Employee Monitoring and Workplace Privacy: A Practical Guide.

Template 5: Just-in-time notices and permission prompts

Purpose: a short explanation at the moment a sensitive or unexpected collection begins. Owner: the product manager for the feature, with privacy counsel approving the text. When to use: before requesting location, contacts, camera, microphone, health data, or cross-app tracking, and before any collection a user would not expect.

LOCATION (Harbor & Pine app, shown before the system prompt)
See what's in stock near you? We'll use your precise location only
while you use the app, only to find nearby stores, and we delete it
after 24 hours. We don't share it with advertisers.
[Continue]  [Not now]

iOS PURPOSE STRING (NSLocationWhenInUseUsageDescription)
"Used to show inventory at stores near you. Not shared with
advertisers."

CROSS-APP TRACKING (shown before Apple's App Tracking Transparency
prompt)
If you allow tracking, we'll share your device's advertising ID with
our ad partners so we can measure our ads and show you Harbor & Pine
ads in other apps. If you don't, you'll still see ads, but they won't
be based on your activity in other companies' apps and sites.
[Continue]

HEALTH DATA (Stride Collective onboarding)
Stride uses your workouts, heart rate, and weight entries to build
your training plan. We never use them for advertising, and we never
give them to advertising companies. You can delete them anytime in
Settings > Data.
[Continue]

Drafting commentary.

• The developer writes the purpose string, so it is the company's representation, subject to the same Section 5 analysis as the policy. Keep it consistent with the policy, the app store label, and the SDK inventory.
• Make the pre-prompt honest about the consequences of saying no, and never imply the app will not work when it will.
• Stride's health notice is only true if the advertising events are gone. In the article's scenario, the pixel and attribution SDK received workout data; publishing this text without first fixing the data flow would repeat the Flo Health and BetterHelp fact pattern. If any health data will go to a third party, use Template 8 instead.
• Record which version of the prompt each user saw (Template 14). The FTC's 2013 staff report on mobile privacy disclosures recommended just-in-time disclosures for sensitive collection, and in litigation the question will be what the user was shown.
• App store requirements are separate obligations. See Legal Issues for Mobile Applications: Privacy.

Template 6: Cookie banner, preference center, and consent-state matrix

Purpose: the choice interface for cookies, pixels, and SDKs, and the engineering specification that makes the interface true. Owner: marketing operations and engineering, with privacy counsel approving. When to use: on every website and in apps that use advertising or analytics SDKs.

BANNER: OPT-IN JURISDICTIONS (EEA, UK, and any opt-in requirement)
We use cookies and similar tools. Some are needed to run the site.
With your permission, we'd also like to use analytics cookies to see
how the site is used and advertising cookies so we and our partners
can show you relevant ads on other sites.
[Accept all]   [Reject all]   [Choose]
(Buttons equal in size, color, and placement.)

BANNER: US OPT-OUT JURISDICTIONS
We and our advertising partners use cookies and pixels to show you
ads based on your activity on this site. Some state laws treat this as
a "sale" or "sharing" of personal information. You can opt out at any
time, and we honor Global Privacy Control.
[Opt out]   [OK]   [Settings]

PREFERENCE CENTER CATEGORIES
Strictly necessary (always on): security, load balancing, checkout.
Analytics: [vendors]. Helps us understand how the site is used.
Advertising: [vendors]. Lets us and our partners show you ads on
other sites based on your activity here.
[Session recording: (vendor). Off unless you turn it on.]

Drafting commentary.

• Symmetry is a legal requirement in California. The more privacy-protective option may not be harder, longer, or less visible (Cal. Code Regs. tit. 11, § 7004), and consent obtained through a dark pattern is not consent (Cal. Civ. Code § 1798.140(h), (l)). The California Privacy Protection Agency's 2025 Honda order faulted a tool that took one click to accept and more to decline. See Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule.
• The matrix is the contract between legal and engineering. Test every row with a network capture after every release; a banner that records a choice and fires the same tags regardless is evidence against the company.
• Recording waits for consent. Under the all-party consent statutes, consent must precede the recording, Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022), and whether a policy supplied implied consent became a disputed fact in Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022). The federal one-party rule in 18 U.S.C. § 2511(2)(d) does not protect a company sued under a state statute.
• Keep video viewing events out of advertising pixels unless you have consent in the separate form the VPPA requires, 18 U.S.C. § 2710(b)(2)(B).
• Litigation and inventory tools: Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech and Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense.

Template 7: Your Privacy Choices page

Purpose: the page behind California's opt-out links and the equivalent links other states require. Owner: privacy lead and engineering. When to use: whenever the business sells or shares personal information, processes it for targeted advertising, or uses sensitive personal information beyond the permitted purposes.

YOUR PRIVACY CHOICES

Opt out of sale, sharing, and targeted advertising
[Toggle: Off / On]
When this is on, we stop selling or sharing your personal information
and stop using it for targeted advertising [for this browser / for
your account when you are logged in]. No account or proof of identity
is needed.

Global Privacy Control
If your browser sends a Global Privacy Control signal, we treat it as
a request to opt out for that browser [and, if you are logged in, for
your account].
Status: [Opt-out preference signal honored / No signal detected]

Limit the use of my sensitive personal information
[Include only if sensitive information is used beyond the permitted
purposes.] [Toggle]

Offline and email-based opt-outs
[How to opt out for loyalty or in-store data: phone number, form]

Authorized agents
[How an agent may submit a request on your behalf]

Questions: [privacy email] | [toll-free number]

Drafting commentary.

• Links and labels. California requires "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or one alternative link titled "Your Privacy Choices" or "Your California Privacy Choices" with the prescribed icon (Cal. Civ. Code § 1798.135; Cal. Code Regs. tit. 11, §§ 7013 to 7015).
• No verification for opt-outs. A business may not require a verifiable consumer request to opt out of sale or sharing, and must act on the request within 15 business days (Cal. Code Regs. tit. 11, § 7026). Excessive verification demands were part of the Honda order.
• Signals. The regulations require businesses to treat a qualifying opt-out preference signal as a valid opt-out (Cal. Code Regs. tit. 11, § 7025), and California's amended regulations call for the site to display whether it processed the signal. The status line is also the cheapest proof that it did. Many other state laws now require recognition of universal opt-out signals.
• Scope statements must match the code. If the toggle only sets a cookie, say "for this browser," and do not claim the opt-out follows the account unless it actually does.

Template 8: Statutory consents that live outside the policy

Purpose: stand-alone consent instruments for the categories where a privacy policy can never supply consent. Owner: privacy counsel; the product owner implements and logs. When to use: before collecting or sharing consumer health data, before collecting biometric identifiers, and before enrolling anyone in marketing texts.

8A: Consumer health data (collect and share as separate choices)

YOUR HEALTH DATA
Stride collects the workouts, heart rate, sleep, and weight entries you
log or sync from a connected device. We use them to build and adjust
your training plan. [Read our Consumer Health Data Privacy Policy]

[ ] I agree that Stride may COLLECT my health data for my training plan.

[ ] I agree that Stride may SHARE my workout summaries with [named
    research partner] to [study training outcomes]. This is optional
    and does not affect the app.

You can withdraw either consent in Settings > Privacy at any time.
(Both boxes unchecked by default. The training plan needs only the first.)

8B: Biometric notice and written release (Illinois and similar laws)

FACE SIGN-IN: NOTICE AND RELEASE
What we collect: a mathematical template of your facial geometry,
created from the selfie you take when you turn on Face Sign-In.
Why: only to verify your identity when you sign in.
How long: we permanently delete the template when you turn off Face
Sign-In, close your account, or 3 years after your last sign-in,
whichever comes first.
Who receives it: only [identity verification vendor], which processes
it for us under a contract that forbids any other use. We never sell,
lease, trade, or otherwise profit from it.
Our retention and destruction policy: [link to public policy]

By typing your name and selecting "I agree," you authorize Stride to
collect, store, and use your facial geometry as described above.
Name: [________]   Date: [auto]   [I agree]   [Not now]

8C: Marketing text messages

[ ] Text me Harbor Rewards offers. By checking this box, I agree to
    receive recurring automated marketing text messages from Harbor &
    Pine at the mobile number I provided. Consent is not a condition of
    any purchase or of joining Harbor Rewards. Message frequency varies.
    Message and data rates may apply. Reply STOP to cancel or HELP for
    help. [Terms] [Privacy Policy]
(Unchecked by default; shown separately from the Rewards enrollment.)

Drafting commentary.

• Health data. Washington's My Health My Data Act requires consent to collect consumer health data and a separate consent to share it (each unless the collection or sharing is necessary to provide the product or service the consumer asked for), a consumer health data privacy policy linked from the homepage, and a signed authorization before any sale. Never make the sharing consent a condition of the service. The FTC's GoodRx and BetterHelp orders went further and banned sharing health data for advertising altogether. If the app pulls data from more than one source, check the Health Breach Notification Rule, 16 C.F.R. Part 318.
• Biometrics. The release follows 740 ILCS 14/15(b): written notice that a biometric identifier is being collected, the specific purpose and length of term, and a written release, which the 2024 amendment confirms may be an electronic signature. The public retention schedule required by section 15(a) must exist before the first template is created. A person is "aggrieved" by a violation without proving separate harm, Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, and a 15(b) failure is a concrete injury in federal court, Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020). See Biometric Data Privacy Laws and Their Impact on AI Development.
• Text messages. Prior express written consent for autodialed or prerecorded marketing requires a signed agreement (an electronic signature under E-SIGN, 15 U.S.C. § 7001, counts) that authorizes marketing messages to a designated number and discloses that consent is not a condition of purchase, 47 U.S.C. § 227 and 47 C.F.R. § 64.1200(f)(9). Consent is limited to the purpose for which the number was given, Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017). Keep the checkbox separate from the loyalty enrollment so a member can join without agreeing. See TCPA Text Message Marketing Compliance Checklist: A Practical Checklist.
• Other stand-alone instruments follow the same pattern: VPPA consent in a separate form, 18 U.S.C. § 2710(b)(2)(B); verifiable parental consent under the COPPA Rule, 16 C.F.R. Part 312; and HIPAA authorizations for marketing under 45 C.F.R. Part 164.

Template 9: Notice of financial incentive (loyalty program)

Purpose: the California notice required before a consumer joins a program that offers a benefit in exchange for personal information. Owner: the loyalty program manager, finance (for the valuation), and privacy counsel. When to use: before launching or materially changing any loyalty program, data-linked discount, sweepstakes, or similar offer. The sample is Harbor Rewards.

HARBOR REWARDS: NOTICE OF FINANCIAL INCENTIVE

What you get: 1 point per dollar spent; a $10 reward for every 200
points; a birthday discount; early access to sales.

What we collect: your name, email, phone number, birthday, and
purchase history, including in-store purchases you link to your
account.

How we use it: to track points and rewards, personalize offers, and
analyze program performance. Partner offers from other brands are a
separate choice; we send nothing to partner brands unless you turn
partner offers on.

How to join: select "Join Harbor Rewards" and confirm. Joining is
optional.

How to leave: Account > Rewards > Leave program, or call [number].
Your points expire when you leave; your order history stays under our
normal retention schedule.

What your data is worth to us: we estimate the value of a typical
member's personal information at about $[X] per year. We calculated
this as [the additional gross profit from members' purchases
attributable to personalized offers, minus the cost of rewards,
divided by the number of active members], using our [year] results.

Drafting commentary.

• Required contents. A succinct summary of the incentive, its material terms, the categories of personal information involved, how to opt in, how to withdraw, and a good-faith estimate of the value of the consumer's data with the method used to calculate it (Cal. Civ. Code § 1798.125(b); Cal. Code Regs. tit. 11, § 7016). Section 7081 lists acceptable valuation methods; finance should keep the workpapers.
• Opt-in, not default. Enrollment requires the consumer's prior opt-in consent, and the consumer may revoke it at any time.
• Partner offers change the analysis. Sending purchase histories to other brands is a sale or sharing, which needs the opt-out mechanism and accurate disclosure, and many state laws restrict selling loyalty data to third parties. Starting partner offers only for data collected after a member opts in avoids the retroactive-change problem in Template 11.
• Texts are a separate consent (Template 8C). Update the policy, the notice at collection on the sign-up form, and the program terms in the same release, and archive all three (Template 13).

Template 10: Prospective material change notice

Purpose: advance notice of a material change that will apply going forward. Owner: privacy counsel and the communications or lifecycle-marketing team. When to use: any change the Template 12 assessment classifies as material.

EMAIL
Subject: We're updating our Privacy Policy on [date]

On [date at least 30 days away], we're updating our Privacy Policy.
Here is what's changing, in plain terms:
  - [Change 1: what, why, and what it means for you]
  - [Change 2]
What isn't changing: [for example, we still don't sell your personal
information for money].
Your choices: [opt-out links or settings].
Read the new policy: [link]. Compare it with the current version:
[link to redline].
These changes apply only to information we collect on or after
[effective date]. [If the change will apply to information we already
have, we will ask for your permission first.]

IN-APP OR WEBSITE BANNER (shown at next sign-in until dismissed)
We're updating our Privacy Policy on [date]. [One-line summary.]
[Review changes]   [Dismiss]

Drafting commentary.

• Notice has to reach people. Posting a revised document does not bind existing customers who were never told, Douglas v. U.S. District Court, 495 F.3d 1062 (9th Cir. 2007), and an unrestricted right to rewrite terms at will helped make an arbitration clause illusory in In re Zappos.com, Inc., Customer Data Security Breach Litigation, 893 F. Supp. 2d 1058 (D. Nev. 2012). CalOPPA requires the policy to describe how users will be notified of material changes, so follow the process the policy describes.
• "Continued use means acceptance" works, if at all, only for prospective changes with real notice. It never authorizes applying a materially different use to data already collected.
• Sector procedures run in parallel: a revised GLBA notice and a new opt-out opportunity before new sharing, 15 U.S.C. § 6802 and 12 C.F.R. Part 1016; a revised HIPAA notice before a material change takes effect; and new verifiable parental consent under COPPA.
• Keep the email, the banner, the send logs, and the redline with the version record (Template 13).

Template 11: Retroactive consent request and data segregation record

Purpose: permission to apply a materially different use to data already collected, and the record that keeps non-consenting users' data out of the new use. Owner: privacy counsel, the data platform owner, and the product owner for the new use. When to use: whenever Template 12 classifies a change as material and retroactive, including AI or model training on existing data.

CONSUMER VERSION (Stride Collective research use)
Can we use your past workouts for research?
When you logged these workouts, we told you we'd use them only to run
your training plan. We'd now like to use your workout history from
[date] onward, with your name and contact details removed, in a study
with [research partner] on [topic]. This is entirely optional. If you
say no, nothing changes.
[Yes, include my past workouts]   [No thanks]
(No preselected answer. Silence or dismissal counts as "No.")

BUSINESS-CUSTOMER VERSION (Ledgerline AI forecasting)
AI Features Addendum: Customer may elect to allow Ledgerline to use
Customer Data, including Customer Data received before the Addendum
Date, to train and improve Ledgerline's cash-flow forecasting models
shared across customers. If Customer does not elect, Ledgerline will
use Customer Data only to provide the Services to Customer and will
exclude it from all shared-model training. Election: [Opt in / Decline]
Authorized signer: [____]   Date: [____]

DATA SEGREGATION RECORD
Data set: [name]                Collected under policy versions: [x-y]
Original permitted uses: [list]
New use requiring consent: [description]
Consent field: [consent_status: granted / declined / unknown]
Default for "unknown": [excluded]
Enforcement point: [pipeline filter, table, or job name]
Verification test: [query or test proving excluded records are absent
from the training set], run on [date] by [name]
Model lineage: [models trained, data snapshot IDs]

Drafting commentary.

• The rule. Applying a material change to data collected under a prior promise requires affirmative express consent: the Gateway Learning order (2004), the Facebook order (2011), and the 1Health.io/Vitagene order (2023). In February 2024 the FTC's staff warned that quietly changing terms to permit AI training on previously collected data could be unfair or deceptive under 15 U.S.C. § 45.
• The remedy if you get it wrong is the model. The Everalbum, Ring, and Rite Aid orders required deletion of models and algorithms built with improperly used data, which is why the segregation record tracks model lineage.
• B2B is different, not easier. Ledgerline's customers' own privacy notices told their clients what would happen to their data; Ledgerline cannot consent on their behalf, and a customer's election should come with a representation that it has the notices and consents the new use requires.
• Default to exclusion. Unknown consent status means the data stays out. In litigation consent is an affirmative defense the company must prove, Calhoun v. Google LLC, 113 F.4th 1141 (9th Cir. 2024) (quoting Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017)), and courts measure it against the specific use, Campbell v. Facebook Inc., 77 F. Supp. 3d 836 (N.D. Cal. 2014).

Template 12: Privacy change request and materiality assessment

Purpose: the gate every new feature, vendor, SDK, data use, or retention change passes through before launch. Owner: the requesting team completes sections 1 to 8; privacy counsel decides materiality and required actions. When to use: before go-live of anything that changes what data is collected, who receives it, why it is used, or how long it is kept.

PRIVACY CHANGE REQUEST                         ID: [  ]
Requested by: [name, team]                     Target launch: [date]
1. What is changing? [feature, vendor, SDK, data use, retention, market]
2. Data involved: [categories]. Any sensitive, children's, health,
   biometric, precise location, financial, or video-viewing data? [Y/N]
3. New recipients? [names; service provider or third party; contract
   terms checked on (date)]
4. New purpose? [describe; compatible with the purposes disclosed?]
5. Will it apply to data already collected? [Y/N; policy versions]
6. Jurisdictions affected: [states; EEA/UK]
7. Statements affected: [policy sections; notices at collection;
   just-in-time notices; banner; app store labels; permission strings;
   help-center pages; DPAs; sales and security materials]
8. Choices affected: [does it remove or weaken any choice?]

MATERIALITY (any box checked = presumptively material)
[ ] new category of sensitive data   [ ] new category of recipient
[ ] new purpose                      [ ] begins sale, sharing, or
[ ] longer retention                     targeted advertising
[ ] fewer or weaker choices          [ ] applies to existing data

DECISION: [not material / material, prospective only / material and
retroactive]
REQUIRED ACTIONS: [Template 10 notice] [Template 11 consent and
segregation] [sector procedures] [update Templates 2 to 7]
[archive under Template 13]
APPROVALS: privacy counsel [ ]  system owner [ ]  security [ ]
executive sponsor [ ]        Go-live gate cleared on: [date]

Drafting commentary.

• Materiality tracks what consumers care about. The FTC's Deception Policy Statement treats information as material if it is likely to affect a consumer's choice or conduct, and health, location, children's, and financial data are material almost by definition. When in doubt, treat the change as material; the cost is an email, and the alternative is a deception count.
• Retroactive means a materially different use of data already collected, such as AI training, a new research use, or sending existing loyalty data to new partners. Those changes go to Template 11.
• Sector procedures: a revised GLBA notice and new opt-out before new sharing, 15 U.S.C. § 6803 and 12 C.F.R. Part 1016; a revised HIPAA notice before the change takes effect, 45 C.F.R. § 164.520; new verifiable parental consent for a material change under 16 C.F.R. § 312.5; and, for GDPR data, information to the data subject before processing for a new purpose (Article 13(3)).
• Write the form as if a regulator will read it, because one may. Keep counsel's legal advice in a separate privileged memo; the form itself is a business record.
• The vendor half of the gate belongs in the vendor program: Building a Vendor and Third-Party Risk Management Program.

Template 13: Version log and archive manifest

Purpose: proof of what every notice said, when, and where. Owner: the privacy lead maintains the log; a named custodian maintains the archive. When to use: every time any public privacy statement changes, including banner copy, permission strings, and app store labels.

ARCHIVE MANIFEST: VERSION [x]                    Custodian: [name]
Files: policy as served (HTML), rendered PDF, redline against prior
       version, translations [languages], notice-at-collection snippets,
       banner and preference-center copy, permission strings
Hashes: SHA-256 for each file, computed [date, time UTC]
Screenshots (desktop and mobile; each jurisdiction variant):
  [ ] homepage footer link        [ ] account sign-up screen
  [ ] checkout                     [ ] cookie banner, opt-in variant
  [ ] cookie banner, US variant    [ ] preference center
  [ ] app onboarding and prompts   [ ] app store privacy labels
  [ ] Your Privacy Choices page with signal status
Capture method: [tool, browser, device]; captured by [name], [date]
Storage: [system]; write-once; retained [period]; legal hold [Y/N]

Drafting commentary.

• Why it matters. In Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022), the company could not produce the policy it claimed was posted in 2018, which left implied consent a disputed fact. In In re Google, Inc. Privacy Policy Litigation, 58 F. Supp. 3d 968 (N.D. Cal. 2014), the court had to sort out which version governed which purchase. In In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), a renamed document broke incorporation. A log with hashes and screenshots answers all three problems.
• Keep the archive longer than the longest limitations period that could apply. Illinois applies a five-year limitations period to every BIPA claim (Tims v. Black Horse Carriers, Inc., 2023 IL 127801), and four years is the federal catch-all for TCPA claims.
• Plan authentication now. Prior versions come in through a witness with knowledge under Fed. R. Evid. 901 or by certification of electronic records under Fed. R. Evid. 902 (paragraphs (13) and (14)); Template 16 is built for that.
• Keep translations and app store labels in the same version record. A label or translation that lags the policy is a separate public statement with its own date.

Template 14: Consent record schema and receipt

Purpose: the minimum fields a consent record needs to prove what a user saw and chose. Owner: engineering, with the consent management vendor; privacy counsel approves the schema. When to use: for every consent the business relies on: cookies and tracking, sensitive and health data, biometrics, marketing texts, retroactive uses, financial incentives, and children's data.

CONSENT RECEIPT (email or in-app)
On [date], you chose: [analytics: on; advertising: off; share workouts
with (partner): on]. You can change these choices anytime at [link].
Reference: [consent ID]

Drafting commentary.

• Consent is an affirmative defense the company must prove, Calhoun v. Google LLC, 113 F.4th 1141 (9th Cir. 2024), and courts ask what a reasonable user would have understood from the disclosures actually shown, Smith v. Facebook, Inc., 745 F. App'x 8 (9th Cir. 2018). A record without the notice version and interface variant proves only that a button was clicked.
• Admissibility. Records made at or near the time by the system and kept in the regular course of business come in under Fed. R. Evid. 803(6). E-SIGN, 15 U.S.C. § 7001, lets electronic records satisfy retention requirements if they accurately reflect the information and remain accessible.
• Retention periods. California requires records of consumer requests and responses to be kept for at least 24 months (Cal. Code Regs. tit. 11, § 7101); keep TCPA consents for at least four years and BIPA releases for at least five.
• Do not over-collect to prove consent. The record should identify the person pseudonymously and point to the notice, not copy the underlying data.

Template 15: Accuracy audit worksheet

Purpose: a sentence-by-sentence comparison of every public privacy statement with the evidence. Owner: the privacy lead, with an engineer running the captures. When to use: at least every 12 months, on every trigger in Template 12, and on receipt of a demand letter or regulator inquiry.

Drafting commentary.

• Audit against six sources: the data map, the vendor contracts, a capture in each consent state, the consent platform's behavior (including signal handling), the retention schedule and deletion logs, and every other public statement. Help-center answers matter as much as the policy; one revived the claims in In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020).
• Fix the practice or fix the words, and record which. Changing the words to match a newly discovered practice is a prospective change at best; if the practice affected data collected under the old words, run Templates 12 and 11.
• Plaintiffs and regulators build the same worksheet from public sources, so assume the gaps you find will be found. For the capture method, see Auditing Your Website Tracking Stack: A Practical Guide; for the security statements, see Cybersecurity Regulatory Compliance Checklist: A Practical Checklist.

Template 16: Custodian declaration for policy versions and consent records

Purpose: a foundation for prior policy versions, screenshots, and consent logs in litigation or an investigation. Owner: litigation counsel drafts; the archive custodian and the consent-system owner sign only what they know. When to use: in response to a motion, a discovery dispute, or an arbitration demand in which what the user saw is contested.

DECLARATION OF [NAME]
I, [name], declare:
1. I am [title] at [company]. I am responsible for [the company's
   archive of public privacy disclosures / its consent management
   system]. I have personal knowledge of the facts stated here and, if
   called as a witness, could testify to them.
2. In the regular course of business, the company archives each
   version of its privacy policy and related notices when published,
   storing the file as served, a rendered copy, screenshots of the
   collection points it governed, and a SHA-256 hash computed at the
   time of archiving.
3. Exhibit A is a true and correct copy of the Privacy Policy, version
   [x], retrieved from the archive on [date]. Its hash matches the hash
   recorded on [date]. It was in effect from [date] to [date].
4. Exhibit B is a true and correct copy of screenshots of [the sign-up
   screen and cookie banner] as displayed during that period, captured
   on [date] by [method].
5. The consent management system records each choice at the time it is
   made, including [fields]. These records are kept in the regular
   course of business and relied on to honor users' choices.
6. Exhibit C is a true and correct export of the consent records for
   [identifier], generated on [date] by [method] without alteration.
I declare under penalty of perjury under the laws of the United States
of America that the foregoing is true and correct.
Executed on [date] at [city, state].            [signature]

Drafting commentary.

• Rules. Authentication by a witness with knowledge or distinctive characteristics, Fed. R. Evid. 901; certification of records generated by an electronic process or copied from an electronic device, Fed. R. Evid. 902 (paragraphs (13) and (14), using the certification and notice procedure of paragraph (11)); business records, Fed. R. Evid. 803(6); and the unsworn declaration form in 28 U.S.C. § 1746.
• Sign only what you know. In Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022), a witness who had declared that the policy was posted later testified that he could not produce the version in effect in 2018. A declaration that overreaches is worse than none.
• Never present a reconstruction as an original. If a version was rebuilt from a web archive or source control, say so and explain how.
• Preservation comes first. Tag manager histories, consent platform configurations, and SDK versions are overwritten routinely; once a dispute is reasonably anticipated, losing them invites measures under Fed. R. Civ. P. 37(e). Production runs through Fed. R. Civ. P. 26 and Fed. R. Civ. P. 34. See Authenticating Website Evidence: A Practical Checklist and Capturing the Web: A Practitioner's Guide to Authenticating Website Screenshots as Evidence in Federal Court.

Template 17: Inconsistency chart for plaintiffs, regulators, defendants, and acquirers

Purpose: a side-by-side map of what was said, what happened, and what follows legally. Owner: whoever is evaluating the exposure: plaintiff's counsel screening a case, a regulator, defense counsel preparing a response, or an acquirer's diligence team. When to use: before filing, before responding to a demand, and before signing a purchase agreement.

ACQUIRER ADDITION: SAMPLE REPRESENTATION
Privacy. Since [lookback date]: (a) the Company has complied in all
material respects with each of its Privacy Policies and with Privacy
Laws; (b) no Privacy Policy has contained a materially inaccurate or
misleading statement about the Company's practices; (c) the Company
has not applied a material change in any Privacy Policy to Personal
Information collected before the change without the consent Privacy
Laws require; and (d) the Company may lawfully transfer the Personal
Information to Buyer and Buyer may use it as the Company used it
before Closing.

Drafting commentary.

• Both sides use the same chart. Plaintiffs and regulators fill it from captures and archives; defense counsel fills it first, from the company's own records, to decide what to fix, what to preserve, and what defenses are real (see Answer and Affirmative Defenses Checklist: A Practical Checklist).
• For acquirers, the promises travel with the data. In bankruptcy, a sale that would violate the policy in effect at filing needs court approval after review by a consumer privacy ombudsman, 11 U.S.C. § 363(b)(1) and 11 U.S.C. § 332. Pair the representation with a special indemnity for known tracking exposure and a post-closing plan to honor old promises for old data; see IP Due Diligence Checklist for Mergers and Acquisitions: A Practical Checklist and Representations, Warranties, and Indemnification in Acquisition Agreements: Where the Money Actually Moves.

Common mistakes when using these templates

• Filling the brackets from memory or from a competitor's policy instead of from the data map and a capture.
• Publishing a summary that is more reassuring than the detailed sections beneath it.
• Approving banner copy that the code does not implement, then never re-testing it.
• Using one checkbox for terms acceptance, marketing texts, and data sharing at once.
• Updating the policy but not the notices at collection, permission strings, app store labels, and help-center pages.
• Storing consent as a single yes-or-no flag with no notice version, interface variant, or timestamp.
• Keeping the only copy of old policies in a vendor dashboard or a public web archive.

Frequently asked questions

Can we publish Template 1 once the brackets are filled? Only after every sentence has been checked against its source of truth, which is what Privacy Policy Drafting and Review Checklist: A Practical Checklist is for. Delete any section that does not apply; boilerplate about practices you do not have is still a representation.

Do US websites need a cookie banner? Not everywhere, and not always an opt-in one. But the state laws require an opt-out for sale, sharing, and targeted advertising, a growing majority require honoring universal opt-out signals, sensitive data generally needs opt-in consent, and session replay and chat recording need consent before they start under the all-party consent statutes. Template 6's matrix shows how one interface can handle all of those.

How much notice should we give before a policy change takes effect? No single rule applies. Thirty days is a common practice, sector rules add their own timing, and the real test is whether the notice reaches users before the change applies to them. Notice is never enough for a material change to data already collected; that requires consent (Template 11).

Can one checkbox cover the terms, the privacy policy, and marketing consent? No. California's definition of consent excludes acceptance of general terms that bundle unrelated matters, text-message consent cannot be a condition of purchase, and Washington requires separate consents to collect and to share health data. Use separate, unchecked choices.

What if most users ignore a retroactive consent request? Then the change does not apply to their data. Use the segregation record in Template 11, apply the new use only to data collected after proper notice, or drop the change.

Practical takeaways

• Fill every template from records, not recollection, and delete what is not true.
• Make each notice layer accurate on its own, starting with the summary.
• Keep statutory consents separate, specific, unchecked by default, and revocable.
• Treat the consent-state matrix as an engineering specification and test it after every release.
• Run every change through a materiality gate; get consent before applying a material change to old data.
• Log, hash, screenshot, and archive every version, and keep consent records that show what each user saw.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Companion documents in this series

• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: the law, the enforcement record, and the case law behind these templates.
• Drafting and Maintaining a Privacy Policy: A Practical Guide: the step-by-step process for building and maintaining the policy.
• Privacy Policy Drafting and Review Checklist: A Practical Checklist: a line-by-line review of a draft or an existing policy.

Related Articles and Guides

• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the state laws behind the notice, opt-out, and consent templates.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: why consent must come before recording and tracking.
• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: children's notices and verifiable parental consent.
• Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration: assent screens and change clauses for the terms that incorporate the policy.
• The TCPA and Text Message Marketing: Consent, Revocation, and Class Action Exposure: the law behind the text-message consent template.
• Developing a Privacy Compliance Program: the program that keeps these documents true.

Related Checklists

• Website Tracking Compliance Checklist: A Practical Checklist: testing whether the banner and opt-out page do what they say.
• Data Subject Rights Request Handling Checklist: A Practical Checklist: operating the rights described in the policy.
• COPPA Children's Privacy Compliance Checklist: A Practical Checklist: the children's instruments that sit beside the policy.
• CAN-SPAM Email Marketing Compliance Checklist: A Practical Checklist: aligning email statements with list operations.

Related Toolkits

• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: tag inventories, consent verification, and vendor clauses.
• Privacy and Data Protection Toolkit: Building and Running a Privacy Program: data maps, assessments, and program records.
• Consumer Marketing Compliance Toolkit: TCPA, CAN-SPAM, Auto-Renewal, and Endorsements: consent records for calls, texts, email, and subscriptions.
• Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design: children's and student notices and consents.
• Cybersecurity Compliance Toolkit: Written Information Security Programs, Risk Assessments, and Incident Disclosure Memos: the security program the policy's security paragraph describes.
• AI Governance Toolkit: Inventory, Risk Classification, and Controls: inventorying the AI uses that trigger Templates 11 and 12.