Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC

Summary. A privacy policy is a set of factual representations about what a business does with personal information, and the FTC, state attorneys general, and class action plaintiffs read it that way. This article explains the legal sources of the obligation to have one and to tell the truth in it: Section 5 of the FTC Act and the Deception and Unfairness Policy Statements, the enforcement record from Gateway Learning and Google Buzz through GoodRx, BetterHelp, Avast, and the location-data cases, CalOPPA and the CCPA/CPRA notice regulations, the other state comprehensive laws, and the sector rules under COPPA, GLBA, HIPAA, FERPA, the FCRA, the TCPA, CAN-SPAM, and the VPPA. It then covers GDPR transparency for US companies, app store privacy labels, BIPA, and wiretap consent for session replay. It explains how courts treat a policy as a contract, as the measure of consent, and as the source of privacy expectations, including the circuit differences on standing. The drafting half covers the standard architecture, layered and just-in-time notices, consent flows and the dark-pattern rules, accuracy audits, the retroactive-change rule, version control, and how policies are proved in litigation. It closes with strategy for the company, the plaintiff, and the acquirer, three worked examples, an FAQ, and practical takeaways.

Suppose Stride Collective, a fitness app with 400,000 users, has a privacy policy that says "we never share your health data with third parties." The policy was written in 2019 by a contractor who copied it from a competitor. Since then the growth team has added a Meta pixel, a Google Analytics tag, and an attribution SDK, each of which receives workout type, weight entries, and a hashed email address every time a user logs a session. Nobody at Stride has read the policy in four years, and nobody at Stride thinks of the pixel as "sharing."

The FTC does. So does the plaintiffs' bar, which runs the same network capture the FTC's technologists run and then compares the HAR file to the sentence quoted above. The gap between what the policy says and what the servers do is the entire case.

The short answer

• A privacy policy is a legal document because it is a set of factual claims. Under Section 5 of the FTC Act, 15 U.S.C. § 45, a representation that is likely to mislead a reasonable consumer about a material fact is deceptive. A privacy policy that says less than the truth, or more than the truth, is a deceptive representation, and the FTC has been treating it that way since the late 1990s.
• Several statutes require you to have one and dictate what it must say. California's Online Privacy Protection Act (CalOPPA, Cal. Bus. & Prof. Code § 22575) started that in 2004. The CCPA as amended by the CPRA (Cal. Civ. Code §§ 1798.100, 1798.130, 1798.135) and its regulations (Cal. Code Regs. tit. 11, §§ 7010 to 7016) now prescribe contents, placement, and even typography. Roughly twenty states now have comprehensive privacy laws that impose similar lists. Sector laws (COPPA, GLBA, HIPAA, FERPA) require specific notices with specific contents.
• Consent is a separate question from notice, and it is where the newer rules bite: opt-in for sensitive data and children's data, opt-out for sales, targeted advertising, and profiling, honored through universal opt-out signals like Global Privacy Control, and presented without the manipulative design the CPRA regulations and the FTC call dark patterns.
• The policy must be maintained, not just written. A material change applied to data you already collected requires affirmative consent (the Gateway Learning rule, repeated in the Facebook order and the 1Health/Vitagene order). Version control, archiving, and an annual accuracy audit against the data map and vendor list are what keep the document true.
• Courts are split on whether the policy is a contract, but a plaintiff rarely needs it to be. Deception, wiretap, and state consumer protection theories do the work, and the policy supplies the admissions.

Why a privacy policy is a legal document, not a marketing page

The United States has no general federal statute that says "every business must publish a privacy policy." What it has instead is a prohibition on lying, enforced by an agency with a long institutional memory.

Section 5(a) of the FTC Act declares unlawful "unfair or deceptive acts or practices in or affecting commerce." 15 U.S.C. § 45. Two policy statements define the operative terms. The Deception Policy Statement, issued in 1983 and appended to In re Cliffdale Associates, Inc., 103 F.T.C. 110 (1984), sets a three-part test: (1) a representation, omission, or practice (2) likely to mislead consumers acting reasonably under the circumstances, (3) about a matter material to their decision. Express claims are presumed material. The Unfairness Policy Statement (1980), later codified at 15 U.S.C. § 45(n), reaches practices that cause or are likely to cause substantial injury to consumers that consumers cannot reasonably avoid and that is not outweighed by countervailing benefits. Deception needs a false or misleading statement. Unfairness does not; it needs injury.

Apply that to a privacy policy. Every sentence in the document is a representation. "We do not sell your data." "We use industry-standard encryption." "You can delete your account and we will delete your information." "Messages disappear after they are viewed." Each of those has been the subject of an FTC complaint, and in each case the complaint quoted the policy and then described, often with network captures and internal emails, what the company actually did. The gap is the deception count. When the practice is harmful enough on its own (selling precise geolocation that reveals visits to clinics and shelters, or giving every employee access to home security video), the FTC adds an unfairness count that does not depend on the policy at all.

Three structural points matter before we turn to the cases.

First, silence can be deceptive too. The Deception Policy Statement covers omissions. A policy that lists sharing with "service providers" while an SDK streams event-level data to an advertising network that uses it for its own purposes has omitted a material fact. The FTC's position, stated in its 2012 privacy report (Protecting Consumer Privacy in an Era of Rapid Change) and applied in the Goldenshores (Brightest Flashlight) and Sears matters, is that practices consumers would not expect, and would care about, must be disclosed clearly and before collection, not buried on page 30 of a license agreement.

Second, the remedies changed in 2021. For two decades the FTC obtained monetary relief in federal court under Section 13(b), 15 U.S.C. § 53(b). In AMG Capital Management, LLC v. FTC, 593 U.S. 67 (2021), the Supreme Court held that Section 13(b) authorizes injunctions, not restitution or disgorgement. Since then the agency's money comes from three places: civil penalties for violating a rule or an existing order (which is why the Facebook 2019 penalty was $5 billion and the Twitter 2022 penalty was $150 million: both companies were already under orders); consumer redress under Section 19, 15 U.S.C. § 57b, where a rule such as the Health Breach Notification Rule or the COPPA Rule has been violated; and the non-monetary remedies the agency has leaned into hard, including bans on particular data uses, mandated deletion of data and of models trained on it, and twenty-year compliance programs with independent assessments.

Third, the FTC's authority over privacy and security was tested and survived. In FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), the Third Circuit held that inadequate data security can be an "unfair" practice under Section 5 and that Wyndham had fair notice of that, given the FTC's published guidance and complaints. The complaint had also pleaded deception, quoting Wyndham's privacy policy promise to use "industry standard practices" and "commercially reasonable efforts" to protect card data. The opinion is the closest thing to a judicial charter for the privacy-promise theory. The Eleventh Circuit's later decision in LabMD, Inc. v. FTC, 894 F.3d 1221 (11th Cir. 2018), vacating a data-security order because it commanded an indeterminate standard of reasonableness rather than specific acts, limited how the FTC writes injunctive relief, not whether it can bring the case.

The practical consequence is that your privacy policy should be drafted the way a securities lawyer drafts a risk factor: every sentence is true, provable from records, and reviewed by the people who run the systems it describes. For how that fits into the broader program, see Developing a Privacy Compliance Program.

The enforcement record: what each matter stands for

The FTC's privacy docket is a casebook with no judicial opinions. Nearly every matter ended in a consent order, which means the "holdings" are the agency's complaint allegations plus the remedy it extracted. Read as a body, the matters teach a short list of rules. The table lists the ones every drafter should know; the discussion that follows groups them by the lesson.

Retroactive changes and purpose creep

Gateway Learning is the foundation. The company behind "Hooked on Phonics" promised not to share customer information, then quietly changed the policy to permit renting names and ages to marketers and applied the new terms to data collected under the old promise. The FTC called the first act deception and the second unfairness, and the consent order required express opt-in consent before applying any material change to previously collected data. Nearly twenty years later the agency wrote the same term into the Vitagene order for genetic data. The Facebook 2011 complaint was the same theory at scale: a December 2009 settings change made information users had designated as private visible to the world, and the company's "friends only" assurances became false overnight. Twitter's 2022 penalty was purpose creep rather than a policy rewrite: numbers collected "for security" were matched to advertising audiences. The rule across all four: if you want to use existing data for something materially different from what the data subject was told, you ask first.

Undisclosed sharing, especially through pixels and SDKs

Flo, GoodRx, BetterHelp, and the 2024 Cerebral and Monument matters share a fact pattern: a policy that promised confidentiality, a marketing stack that transmitted health-adjacent events to advertising platforms, and a company that did not think of a pixel as "sharing." The FTC thinks of it as sharing, and in GoodRx it also treated it as a "breach of security" under the Health Breach Notification Rule, 16 C.F.R. Part 318, which the agency amended in 2024 to make that reading explicit. Vizio and Avast are the non-health versions: a practice the consumer would never expect (second-by-second viewing data; full browsing histories) disclosed nowhere or described as "anonymized." The companion litigation is covered in Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech.

Deceptive deletion and retention

Everalbum promised that deactivating an account deleted the user's photos; it did not. Amazon's Alexa order (2023) rested on keeping children's voice recordings and transcripts after parents asked for deletion. Chegg, Drizly, and Blackbaud converted retention from a best practice into an order term: each company must now maintain a written retention schedule and delete what it no longer needs. A privacy policy that says "we retain your information as long as necessary" is not false, but it is useless as a disclosure, and the CCPA's notice-at-collection rule now requires either a period or the criteria used to set it. See Data Minimization and Avoiding the Over-Retention of Personal Information.

Algorithmic disgorgement

Everalbum (2021) brought into the mainstream a remedy that first appeared in the 2019 Cambridge Analytica order: destruction not just of unlawfully collected data but of "any models or algorithms developed in whole or in part" using it. The remedy reappeared in the WW/Kurbo children's data order (2022), the Ring order (2023), and the Rite Aid facial recognition order (2023). For a company whose product is a trained model, this is the remedy that matters: the data you collected under a false or missing disclosure poisons everything downstream.

Consent that is not really consent

Google Buzz's opt-out did not work. Nomi's opt-out did not exist. Sears's disclosure was in paragraph 75 of a license agreement. X-Mode and InMarket collected location through SDKs in third-party apps whose consent prompts never mentioned sale to data brokers. And the Epic Games order (2022), while mostly about COPPA and billing, established the FTC's dark-patterns playbook: default-on settings, counter-intuitive button placement, and friction on the privacy-protective choice are themselves unfair. The agency's staff report Bringing Dark Patterns to Light (September 2022) catalogs the designs it will challenge. We return to that in the consent section.

The statutes that require a policy and dictate what it says

The FTC Act punishes false statements; it does not require you to make any. The duty to publish a policy, and the list of what goes in it, comes from state law and from the sector statutes. In practice the state laws set the contents of the general website and app policy, and the sector statutes add separate notices that sit alongside it.

CalOPPA: the original posting mandate

California's Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575 to 22579) applies to any operator of a commercial website or online service, mobile apps included, that collects personally identifiable information from California residents. Because almost every consumer-facing business has California visitors, CalOPPA is the national floor. The operator must "conspicuously post" a policy that:

1. identifies the categories of personally identifiable information collected and the categories of third parties with whom it is shared;
2. describes any process for reviewing and requesting changes to that information;
3. describes how users will be notified of material changes to the policy;
4. states the policy's effective date;
5. discloses how the operator responds to browser "Do Not Track" signals or similar choice mechanisms, if it collects information about a consumer's online activities over time and across third-party sites; and
6. discloses whether other parties may collect that kind of information when a consumer uses the service.

Section 22576 is the part drafters forget. An operator violates the statute not only by failing to post a policy within 30 days after notice of noncompliance but also by failing to comply with its own posted policy, knowingly and willfully or negligently and materially. In California, the policy is a statutory standard of conduct, enforceable by the Attorney General and through the Unfair Competition Law.

The Do Not Track disclosure has an odd afterlife. Almost no site honors the old DNT header, and "we do not respond to Do Not Track signals" is usually the honest answer. Global Privacy Control is a different signal with legal force under the CCPA and several other state laws, so a policy that lumps the two together ("we do not respond to browser privacy signals") is now false for any business those laws cover.

The CCPA and CPRA: one policy and four notices

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, regulates the content, placement, and timing of a privacy policy and up to four separate notices. The regulations (Cal. Code Regs. tit. 11, §§ 7010 to 7016) supply the details.

Three features drive most drafting decisions. First, "sharing" is defined to capture disclosure for cross-context behavioral advertising whether or not money changes hands, so the old argument that a pixel is not a "sale" no longer helps in California. Second, retention must be disclosed by category at the point of collection, which means a retention schedule must exist before the notice can be written. Third, the regulations require a business to treat an opt-out preference signal such as Global Privacy Control as a valid opt-out of sale and sharing (Regs. § 7025) and to say in the policy how it does so.

Enforcement has followed those three features almost exactly. The Attorney General's first public CCPA settlement, with Sephora in 2022 ($1.2 million), rested on undisclosed sales through analytics and advertising trackers and a failure to honor GPC. DoorDash (2024) involved a marketing co-op that counted as a sale. The California Privacy Protection Agency's first CCPA enforcement order, against Honda in 2025, faulted a cookie tool that took one click to accept and two to decline, along with excessive verification demands for opt-outs. Healthline (2025, $1.55 million) was the first action built on the purpose-limitation principle: article titles suggesting a reader's diagnosis went to advertisers. Todd Snyder and Tractor Supply (both 2025) added broken opt-out tooling, missing applicant notices, and ignored GPC signals. Each matter read the notice rules literally, and each compared the policy against what the site's code actually did.

The other state laws and universal opt-out signals

Roughly twenty states now have comprehensive consumer privacy statutes, most built on the Virginia template. Their notice requirements overlap heavily: the categories of personal data processed, the purposes, how to exercise rights and appeal a denial, the categories of data shared with third parties and the categories of those third parties, a contact method, and a clear and conspicuous disclosure of any sale or targeted advertising along with how to opt out. The differences are in the details:

• Specific notice language. Texas requires the words "NOTICE: We may sell your sensitive personal data" (and a parallel biometric notice) if the business does so.
• Sensitive data. Most states require opt-in consent to process sensitive data (health, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, genetic and biometric data, and children's data). California instead gives a right to limit. Maryland goes further, restricting collection of sensitive data to what is strictly necessary and banning its sale.
• Regulations. Colorado's rules prescribe notice content, require notice of material changes, and require consent to be refreshed for sensitive data. Minnesota requires a data inventory and gives consumers a right to question the result of certain profiling decisions.
• Universal opt-out. A growing majority of the state laws require businesses to honor recognized opt-out signals, and California's 2025 Opt Me Out Act requires browser makers to offer such a setting beginning in 2027.
• Health data. Washington's My Health My Data Act requires a separate consumer health data privacy policy linked from the homepage, separate consent to collect and to share, and a signed authorization to sell, all enforceable through a private right of action.

For the full multi-state map, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Sector notices: COPPA, GLBA, HIPAA, FERPA, the FCRA, and the marketing statutes

Sector laws work differently from the general policy. Each prescribes a notice for a defined relationship, often with a mandatory format and a delivery rule, and several replace notice with a consent instrument that a website policy cannot satisfy.

COPPA. The statute, 15 U.S.C. § 6502, and the FTC's rule, 16 C.F.R. Part 312, require an online notice and a direct notice to parents (16 C.F.R. § 312.4) and verifiable parental consent before collection (§ 312.5). The 2025 amendments, with a compliance date of April 22, 2026, require separate parental consent before disclosing children's information to third parties for purposes such as targeted advertising, a written data retention policy disclosed in the online notice, and a written information security program. The Ninth Circuit held in Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023), that COPPA does not preempt state-law claims that parallel its requirements, so a defective children's notice now supports private litigation even though COPPA itself has no private right of action. See Children's Privacy Under COPPA and the Age-Appropriate Design Codes.

GLBA. A financial institution must give an initial notice when the customer relationship begins and, unless the exception in 15 U.S.C. § 6803 applies (no sharing beyond the statutory exceptions and no change in policy), an annual notice. It must offer an opt-out before sharing nonpublic personal information with nonaffiliated third parties outside the exceptions in 15 U.S.C. § 6802. The CFPB's Regulation P, 12 C.F.R. Part 1016, contains the model form, which is a safe harbor only if used as published; the FTC's version, 16 C.F.R. Part 313, still governs certain auto dealers, and the SEC's Regulation S-P, 17 C.F.R. Part 248, governs brokers and advisers. A revised notice and a new opt-out opportunity are required before an institution starts sharing in a way its existing notice did not describe. Electronic delivery requires the customer's agreement, and E-SIGN, 15 U.S.C. § 7001, governs consent to electronic records. The affiliate-marketing rule under the FCRA, 15 U.S.C. § 1681s-3 and 16 C.F.R. Part 680 (with the CFPB's parallel rule in 12 C.F.R. Part 1022), adds a separate notice and opt-out before affiliates use eligibility information for marketing. Fintechs outside the banking system should also remember the CFPB's unfair, deceptive, or abusive practices authority, 12 U.S.C. § 5531 and 12 U.S.C. § 5536, which the Bureau first used for data-security misrepresentations against the payments company Dwolla in 2016.

HIPAA. A covered entity's Notice of Privacy Practices under 45 C.F.R. § 164.520, part of 45 C.F.R. Part 164, has a mandated header, required content (uses and disclosures, individual rights, the entity's duties, how to complain), delivery rules (at first service delivery for direct providers, with a good-faith effort to obtain written acknowledgment), and a posting rule for the entity's website. HHS revised the content rules in 2024, partly to align with the substance-use-disorder records rule in 42 C.F.R. Part 2, and a federal court vacated much of the related reproductive-health rulemaking in 2025, so confirm the current text before revising an NPP. The NPP does not describe what the hospital's website pixels do, which is why hospital tracking cases are litigated under wiretap and consumer protection theories rather than HIPAA alone. Penalties run under 42 U.S.C. § 1320d-5, and knowing wrongful disclosure is a crime under 42 U.S.C. § 1320d-6. For the compliance program, see HIPAA Privacy and Security Compliance for Covered Entities and Business Associates.

FERPA and student data. Schools must notify parents and eligible students annually of their rights under 20 U.S.C. § 1232g and 34 C.F.R. Part 99, including what the school designates as directory information and how to opt out of its release. The Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h, adds notice and opt-out rules for surveys and for marketing uses of student information. An edtech vendor operating as a "school official" must say in its policy that it uses student data only for the school's purposes, and then live by that statement.

The marketing statutes. The TCPA, 47 U.S.C. § 227, and the FCC's rules in 47 C.F.R. Part 64 (47 C.F.R. § 64.1200(f)(9) defines prior express written consent) require a signed written agreement, which E-SIGN allows to be electronic, that clearly authorizes marketing calls or texts to a specific number and discloses that consent is not a condition of purchase. A sentence in a privacy policy is not that agreement. The Supreme Court narrowed the autodialer definition in Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), and the Eleventh Circuit vacated the FCC's one-to-one consent rule in Insurance Marketing Coalition Ltd. v. FCC, 127 F.4th 303 (11th Cir. 2025), but the written-consent requirement for autodialed and prerecorded telemarketing remains, and text messages count as calls. Consent is an affirmative defense the caller must prove, and its scope matters: Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017), measured consent by the purpose for which the number was given. CAN-SPAM, 15 U.S.C. § 7704 and 16 C.F.R. Part 316, is an opt-out regime, but it forbids selling or transferring the address of anyone who has opted out, so a policy's statements about email sharing must match the list operations. See The TCPA and Text Message Marketing: Consent, Revocation, and Class Action Exposure and The CAN-SPAM Act: A Comprehensive Guide for Businesses and Marketers.

Video, cable, and telecom. The Video Privacy Protection Act, 18 U.S.C. § 2710, permits disclosure of viewing history only with informed, written consent "in a form distinct and separate from any form setting forth other legal or financial obligations," renewable at most every two years and revocable. A privacy policy cannot be that form. The Second Circuit's reading of "consumer" in Salazar v. National Basketball Association, 118 F.4th 533 (2d Cir. 2024), which reached a newsletter subscriber, keeps pixel-on-video-page claims alive. Cable operators owe subscribers an annual privacy statement under 47 U.S.C. § 551, and telecommunications carriers need customer approval to use proprietary network information under 47 U.S.C. § 222.

GDPR, app store labels, biometrics, and wiretap consent

Four more regimes shape the document even for a company that thinks of itself as purely domestic.

GDPR transparency for US companies

A US business is subject to the GDPR if it offers goods or services to people in the EU or monitors their behavior there (Article 3(2)). Articles 12 to 14 then govern the notice. Article 12 requires information in a "concise, transparent, intelligible and easily accessible form, using clear and plain language," particularly for children. Article 13 lists what must be given when data is collected from the person: the controller's identity and contact details, the data protection officer's contact, each purpose and its legal basis, the legitimate interests relied on, recipients, international transfers and their safeguards, retention periods or the criteria for them, the data subject's rights (including withdrawal of consent and complaint to a supervisory authority), whether providing the data is required, and meaningful information about the logic of any automated decision-making. Article 14 adds the source and categories of data obtained indirectly, delivered within a reasonable time and at most one month.

Two consequences surprise US drafters. A GDPR notice must tie each purpose to a legal basis, which a US-style list of purposes never does, and catch-all phrases such as "for other business purposes" are noncompliant on their face. The Irish regulator's €225 million fine against WhatsApp in 2021 was a transparency case under Articles 12 to 14, not a security case. Consent has its own definition (Article 4(11): freely given, specific, informed, and unambiguous), its own conditions (Article 7, including withdrawal as easy as giving), and its own age rules (Article 8). The Court of Justice held in Planet49 (2019) that a pre-ticked box is not consent, and France's CNIL fined Google €150 million and Facebook €60 million in early 2022 for making cookie refusal harder than acceptance. The European Data Protection Board's consent guidelines (05/2020) and the transparency guidelines the Board adopted from the Article 29 Working Party (WP260 rev.01) are the working manuals. On transfers, see International Data Transfers After Schrems II: Standard Contractual Clauses and Transfer Impact Assessments.

App store labels and permission prompts

Apple's privacy labels (required since December 2020) and Google Play's Data safety section (required since 2022) are self-reported summaries of what an app collects and why, including what embedded SDKs collect. They are representations to consumers, and nothing in Section 5 exempts them. A label that says "Data Not Collected" while an analytics SDK transmits device identifiers is the Flo Health fact pattern in a different typeface. Apple's App Tracking Transparency prompt (iOS 14.5, 2021) requires permission before tracking a user across other companies' apps and sites, and the developer writes the purpose string, which makes it a just-in-time notice. Since 2024 Apple has also required privacy manifests for commonly used third-party SDKs. Keep the labels, the prompts, and the policy in one source of truth and update all three when an SDK changes. See Legal Issues for Mobile Applications: Privacy.

BIPA and other biometric notice-and-consent rules

The Illinois Biometric Information Privacy Act is the reason "notice" and "consent" are separate words in this field. Section 15(a) (740 ILCS 14/15(a)) requires a publicly available written policy with a retention schedule and destruction guidelines: destroy biometric data when the initial purpose is satisfied or within three years of the person's last interaction, whichever comes first. Section 15(b) requires, before collection, written notice that a biometric identifier is being collected, the specific purpose and length of term, and a written release. Liquidated damages are $1,000 per negligent and $5,000 per intentional or reckless violation (740 ILCS 14/20).

The Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, that a person is "aggrieved" by a violation without pleading separate harm, and in Cothron v. White Castle System, Inc., 2023 IL 128004, that each scan was a separate violation; the legislature responded in 2024 by limiting recovery to one per person per method of collection and confirming that electronic signatures count as written releases. In federal court, the Seventh Circuit held in Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020), that a section 15(b) consent failure is a concrete injury but that the duty to publish a retention policy under section 15(a) runs to the public, and the Ninth Circuit found standing for face-template creation without notice in Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). Texas and Washington have biometric statutes enforced by their attorneys general, and Texas's 2024 settlement with Meta was $1.4 billion. A general privacy policy is never a BIPA release. See Biometric Data Privacy Laws and Their Impact on AI Development.

Session replay, chat, and wiretap consent

The federal Wiretap Act is a one-party consent statute: a party to a communication may consent to its interception unless the interception is for the purpose of committing a crime or tort, 18 U.S.C. § 2511(2)(d), with civil damages of the greater of $100 a day or $10,000 under 18 U.S.C. § 2520. California, Pennsylvania, Florida, and several other states require the consent of all parties, and those statutes drive the session replay and chatbot litigation.

Timing is everything. In Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022), an unpublished decision, the Ninth Circuit read California's section 631(a) to require prior consent, so clicking through a privacy policy after the session replay script had already recorded the visit did not cure anything. In Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022), the Third Circuit held that the interception occurred at the user's browser in Pennsylvania and that the marketing vendor could not invoke a direct-party exception, then remanded the question whether the retailer's privacy policy supplied implied consent. That question turned on whether the policy existed in its claimed form at all: a company witness who had declared the policy was posted later testified that he could not produce the version in effect in 2018. Massachusetts went the other way on coverage in Vita v. New England Baptist Hospital, 494 Mass. 824 (2024), holding that its wiretap statute does not clearly reach web browsing activity.

The practical rule follows: a privacy policy cannot supply consent for recording that starts before the user has seen, and acted on, a notice. Session replay, chat transcripts, and pixel firing on sensitive pages must wait for the banner or the pre-chat notice. The litigation is covered in Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech, and the audit method in Auditing Your Website Tracking Stack: A Practical Guide.

Privacy policies in court: contract, consent, and standing

Private plaintiffs use a privacy policy in three ways: as a contract the company breached, as the measure of what the user consented to, and as the source of the expectation that makes an intrusion "highly offensive." Courts treat the same document differently depending on which use is in play.

Is the policy a contract?

The early answer was mostly no. In Dyer v. Northwest Airlines Corps., 334 F. Supp. 2d 1196 (D.N.D. 2004), the court held that "broad statements of company policy do not generally give rise to contract claims," noted that no plaintiff alleged reading the policy, and found no contract damages. In re Northwest Airlines Privacy Litigation, No. 04-126 (D. Minn. June 6, 2004), added that language vesting discretion in the airline was not an offer and that a policy nobody read could not have been accepted. In re JetBlue Airways Corp. Privacy Litigation, 379 F. Supp. 2d 299 (E.D.N.Y. 2005), was more receptive on reliance but dismissed because the only damage alleged, loss of privacy, is not an economic loss recoverable in contract.

The modern cases turn on incorporation and wording. In In re Facebook, Inc. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), everyone agreed the Statement of Rights and Responsibilities was a contract, but it pointed readers to the "Privacy Policy," and by the relevant date that document had been renamed the "Data Use Policy." The court held that the renamed policy was not incorporated and, in any event, "merely provides information, not commitments." A version-control decision (renaming a document) defeated the contract claim. Yet the same opinion revived the intrusion and wiretap claims because the Data Use Policy and a Help Center page told users that logged-out browsing would not be received. The company won the contract argument and lost the expectation argument with the same words.

When the policy is incorporated, its definitions decide the case. In Carlsen v. GameStop, Inc., 833 F.3d 903 (8th Cir. 2016), a paying subscriber had standing, but the policy defined personal information as data the user voluntarily submitted, which did not include the Facebook ID and browsing history sent through a plug-in. In Kuhns v. Scottrade, Inc., 868 F.3d 711 (8th Cir. 2017), the court read security statements as recitals rather than promises, found no specific breach alleged, and found no actual damages. And in In re Google, Inc. Privacy Policy Litigation, 58 F. Supp. 3d 968 (N.D. Cal. 2014), after two years of motions over Google's 2012 policy consolidation, only an app-purchase subclass's contract and fraud claims survived, and the court had to sort out which policy version governed which purchase.

There is a paradox here worth naming. Companies want the policy to bind users (for consent and arbitration) but not to bind the company (for contract). Courts sometimes give them both, but not reliably, and a narrow definition that wins a contract case is exactly the kind of fine print the FTC treats as creating a misleading net impression under FTC v. Cyberspace.com LLC, 453 F.3d 1196 (9th Cir. 2006).

Formation: browsewrap, sign-in wrap, and changes

Whether a user is bound by terms that incorporate the policy depends on reasonably conspicuous notice and an unambiguous manifestation of assent. A link below the download button was not enough in Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir. 2002), and footer links alone were not enough in Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014). Sign-in wraps were enforced in Meyer v. Uber Technologies, Inc., 868 F.3d 66 (2d Cir. 2017), Oberstein v. Live Nation Entertainment, Inc., 60 F.4th 505 (9th Cir. 2023), and Keebaugh v. Warner Bros. Entertainment Inc., 100 F.4th 1005 (9th Cir. 2024), and rejected in Sgouros v. TransUnion Corp., 817 F.3d 1029 (7th Cir. 2016), Cullinane v. Uber Technologies, Inc., 893 F.3d 53 (1st Cir. 2018), and Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022). The Ninth Circuit's two 2025 decisions, Chabolla v. ClassPass Inc., 129 F.4th 1147 (9th Cir. 2025), and Godun v. JustAnswer LLC, 135 F.4th 699 (9th Cir. 2025), both refused to find assent, the first because a multi-screen checkout never tied a click to the terms and the second because the advisals were inconspicuous or never said what action signaled agreement. Changes are harder still: posting revised terms without notice does not bind existing customers, Douglas v. U.S. District Court, 495 F.3d 1062 (9th Cir. 2007), and an unrestricted right to change terms at will helped make an arbitration clause illusory in In re Zappos.com, Inc., Customer Data Security Breach Litigation, 893 F. Supp. 2d 1058 (D. Nev. 2012). Formation mechanics are covered in depth in Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration.

Consent: how a reasonable user reads the disclosures

Consent is an affirmative defense, and the defendant bears the burden of proving it. Courts ask whether a reasonable user reading all of the company's disclosures would have understood that the specific conduct would occur. In Smith v. Facebook, Inc., 745 F. App'x 8 (9th Cir. 2018), general disclosures that Facebook collected data from third-party sites established consent even for browsing on health sites, and the hospitals' own privacy promises did not bind Facebook, which "is not bound by promises it did not make." In Calhoun v. Google LLC, 113 F.4th 1141 (9th Cir. 2024), the court reversed summary judgment for Google because the Chrome Privacy Notice said that personal information Chrome stores would not be sent to Google unless the user turned on sync, and Google's own terms said service-specific terms control. The specific statement beat the general one. Campbell v. Facebook Inc., 77 F. Supp. 3d 836 (N.D. Cal. 2014), held that consent to processing messages was not consent to scanning them for advertising; Perkins v. LinkedIn Corp., 53 F. Supp. 3d 1190 (N.D. Cal. 2014), found consent to one invitation email but not to two reminders; In re Yahoo Mail Litigation, 7 F. Supp. 3d 1016 (N.D. Cal. 2014), turned on the fact that non-users who emailed Yahoo users had agreed to nothing; and In re Pharmatrak, Inc., 329 F.3d 9 (1st Cir. 2003), warned that consent "should not casually be inferred."

The other side of the coin is that a promise creates liability where none would otherwise exist. Viacom's registration page told parents, "HEY GROWN-UPS: We don't collect ANY personal information about your kids," and that statement kept an intrusion claim alive against Viacom (but not against Google, which made no promise) in In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), following In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), where Google's public statements about respecting cookie blockers set up the claim that circumventing them was highly offensive. For fraud-based consumer claims, the plaintiff must show reliance, and In re iPhone Application Litigation, 6 F. Supp. 3d 1004 (N.D. Cal. 2013), granted summary judgment to Apple because no named plaintiff had read the statements at issue.

Standing and the circuit differences

Federal plaintiffs must show a concrete injury. Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), held that a bare procedural violation is not enough, and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), required a close historical analog, holding that class members whose inaccurate reports were never disseminated, and nearly all members complaining only of defective mailings, lacked standing to seek damages. A defective notice, standing alone, rarely gets a plaintiff into federal court.

The circuits apply those rules differently:

The session replay rulings have an ironic effect. When a removed case fails Article III, the federal court must send it back to state court rather than dismiss it, as the Third Circuit did in Popa v. Harriet Carter Gifts, Inc., No. 25-1760 (3d Cir. Mar. 26, 2026). A defendant that removes and wins on standing may simply relocate the fight. And none of these standing limits binds the FTC or a state attorney general, who need no injured plaintiff at all.

Drafting the policy: architecture, layers, and plain language

Every good policy is built backward from the facts. The drafter's raw materials are the data map, the vendor list, the tag and SDK inventory, the retention schedule, and the rights-request workflow. If those do not exist, the drafting project is really a fact-finding project with a document at the end.

The standard architecture

Layers: notice at collection, the full policy, and just-in-time notices

A layered approach puts the short version first and the detail one click away. The layers are not interchangeable. The notice at collection is a short statement shown where data is collected (a form, an app onboarding screen, a point-of-sale sign) that links to the full policy. A just-in-time notice appears at the moment a particular collection happens, such as a location permission, a microphone prompt, or a contact-upload screen, and it is where the FTC's 2013 staff report on mobile disclosures said sensitive or unexpected collection should be explained. The full policy is the reference document. A consumer should be able to stop at any layer without being misled, which means each layer must be accurate on its own: a summary that says "we don't sell your data" fails even if section 9 discloses "sharing" for advertising.

Words that create liability

Plain language, translation, and accessibility

The CCPA regulations (Regs. § 7003) require notices that are easy to read, use plain and straightforward language, avoid technical and legal jargon, are readable on small screens, are available in the languages the business ordinarily uses for contracts and marketing, and are reasonably accessible to consumers with disabilities, which for online notices generally means following WCAG 2.1. A business that advertises in Spanish but publishes its policy only in English has a compliance gap and a deception argument waiting to be made. If translations exist, version them with the English text and update them together; an "English controls" clause does not cure a misleading translation. For accessibility litigation risk generally, see Website and Mobile App Accessibility Under the ADA: WCAG, Litigation Risk, and Remediation.

Consent flows and dark patterns

Notice tells people what happens. Consent asks permission, and the law now cares how the question is asked. California defines consent as a "freely given, specific, informed, and unambiguous indication" of agreement by a statement or clear affirmative action, and excludes acceptance of general terms that bundle unrelated information, hovering, muting, pausing, or closing content, and agreement obtained through dark patterns (Cal. Civ. Code § 1798.140(h)). A dark pattern is an interface "designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice" (§ 1798.140(l)). Colorado and several other states use the same concept.

The California regulations (Regs. § 7004) turn the principle into design rules: the more privacy-protective path may not be longer or harder than the less protective one; "Accept All" paired with "More Options" is asymmetrical; "Yes" paired with "Ask me later" offers no real choice; double negatives and confusing toggles are out; guilt and shaming language is out; and a consent flow that requires extra clicks to decline will be read as manipulative. The FTC reaches the same designs under Section 5, as its 2022 staff report Bringing Dark Patterns to Light and its Epic Games order show, and the Restore Online Shoppers' Confidence Act, 15 U.S.C. § 8403, separately requires express informed consent for online negative-option offers. For the subscription side of the problem, see Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule.

Records matter because the defendant carries the burden. A company that cannot show what the user saw, and when, has a consent defense in name only.

Keeping the policy true: audits, change management, and the retroactive-change rule

Policies decay. The document is true on launch day and drifts as marketing adds tags, engineering adds SDKs, and product teams find new uses for old data. The fix is a maintenance cycle, not a better first draft.

The accuracy audit. At least annually (California requires the policy to be updated every 12 months) and whenever a trigger occurs, compare the policy against six sources of truth: the data map; the vendor list and the contracts that make each vendor a service provider or a third party; a network capture of the site and apps in each consent state; the consent platform's actual behavior, including GPC handling; the retention schedule and the deletion jobs that implement it; and every other public statement about data, including help center pages (which revived the claims in In re Facebook Internet Tracking), app store labels, security pages, sales decks, and marketing claims. Triggers include a new SDK or vendor, a new category of data, a new purpose (training an AI model is the current favorite), a new jurisdiction, an acquisition, and a regulatory change.

The retroactive-change rule. Prospective changes require notice before they take effect; posting a revision is not notice to existing users, as Douglas held for contract terms. A material change that applies to data already collected requires affirmative express consent, the rule the FTC has applied from Gateway Learning (2004) through Facebook (2011) and Vitagene (2023). In February 2024 the FTC's staff warned specifically that quietly changing terms to allow AI training on previously collected data could be unfair or deceptive. Sector rules add their own change procedures: a revised GLBA notice and new opt-out before new sharing, a revised HIPAA notice before a material change takes effect, and new parental consent under COPPA before a material change in the collection, use, or disclosure of children's information.

Version control. Keep every version with its effective date, a redline against the prior version, the approvals, the products and sites it covered, and screenshots of the collection points and consent flows it governed. Three cases show why. In Popa, the company could not produce its 2018 policy, which left consent a disputed fact. In In re Facebook Internet Tracking, renaming the policy broke its incorporation into the contract. In In re Google, Inc. Privacy Policy Litigation, the court had to determine which version governed each purchase. A version archive with screenshots is the cheapest litigation insurance a privacy program can buy. Retention discipline is its own subject; see Data Minimization and Avoiding the Over-Retention of Personal Information.

Evidence and proof: how a policy gets tested

Privacy cases are document comparisons. The plaintiff, the regulator, or the acquirer lines up what the company said against what its code did and its records show.

How the other side builds the record. Investigators capture network traffic from a browser (a HAR file) or through a proxy for mobile apps, decompile SDKs, test the site with Global Privacy Control turned on, record the consent banner in each state, pull prior policy versions from web archives, submit access requests to see what the company actually holds, and read job postings, marketing decks, and engineering blogs that describe data uses the policy omits. The FTC adds civil investigative demands and its own technologists.

Authentication and admissibility. Prior versions of a policy are authenticated by a witness with knowledge or by distinctive characteristics under Fed. R. Evid. 901, or by certification for electronic records under Fed. R. Evid. 902 (paragraphs (13) and (14)). Courts are divided on taking judicial notice of archived web pages under Fed. R. Evid. 201, so the careful plaintiff obtains a certification from the archive and the careful defendant keeps its own archive. Consent logs come in as business records under Fed. R. Evid. 803(6) if they are kept in the regular course.

Discovery and preservation. The key electronically stored information is the tag manager container history, the consent platform configuration, the event schemas sent to each vendor, and the policy change log, all within the scope of Fed. R. Civ. P. 26 and requestable under Fed. R. Civ. P. 34. Expect a Fed. R. Civ. P. 30(b)(6) deposition on data flows. Tag configurations are overwritten constantly, so the duty to preserve, triggered by a demand letter or a regulator's inquiry, must reach them immediately; losing them invites measures under Fed. R. Civ. P. 37(e).

Strategy for each side

For the company and its drafter

• Draft from evidence, not memory. Interview the people who run the systems, then verify with a network capture. Engineers describe what the code is supposed to do; the capture shows what it does.
• Say less, more precisely. Every adjective is a representation. "We use encryption in transit and at rest for account data" is provable; "we take your privacy seriously" is noise at best and an admission against interest at worst.
• Disclose the surprising things prominently. The FTC's cases punish practices consumers would not expect (Vizio's viewing data, Avast's browsing histories, Twitter's security phone numbers). If a use would surprise a reasonable customer, it belongs in the summary layer and probably needs a just-in-time notice or consent.
• Control the specific statements. Calhoun turned on a product-specific notice; In re Facebook Internet Tracking turned on a help center answer. Inventory every public statement about data, route changes through one owner, and make product-specific notices consistent with the general policy.
• Describe legal process honestly. Say when the company discloses data to law enforcement or in civil litigation and whether it notifies users first. Plaintiffs seeking to identify an anonymous user will test that promise; see Identifying an Anonymous Defendant Online: A Practical Guide.
• Plan the defense before the demand letter. Consent is an affirmative defense, so preserve the evidence that proves it and plead it properly; see Answering a Federal Complaint: Denials, Affirmative Defenses, Counterclaims, and Judgment on the Pleadings.
• Align security statements with the security program. A privacy policy's security paragraph is the deception hook in every breach case, so draft it with the people who own the written information security program; see Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws.

For the consumer, plaintiff, or regulator reading for inconsistencies

• Pull every version. Compare the policy in effect when the plaintiff used the service with the current one, and look for quiet changes, renamed documents, and deleted sentences.
• Compare words to traffic. A HAR capture of a logged-in session on a sensitive page, matched against a sentence like "we never share health information," is the core of most modern complaints.
• Look beyond the policy. Help center pages, app store labels, FAQ answers, and banner text are often more specific than the policy, and the specific statement is the one courts hold against the company.
• Choose theories that survive standing and damages. Contract theories struggle with damages (JetBlue) and, in some circuits, standing (Dinerstein). Statutory claims with liquidated damages, intrusion claims built on a broken promise (Nickelodeon), and state-court filings avoid many of those problems. Consumers who are not litigating can file complaints with the FTC and their state attorney general, which need no injury to act.

For the acquirer in diligence (and the buyer in bankruptcy)

Data is often the asset being bought, and the target's privacy promises travel with it. The FTC told Facebook in 2014 that WhatsApp's promises survived the acquisition and that materially different uses would require affirmative express consent. In bankruptcy, 11 U.S.C. § 363(b)(1) bars the sale of personal information in violation of a privacy policy in effect when the case was filed unless the court approves the sale after a consumer privacy ombudsman, appointed under 11 U.S.C. § 332, reviews it. The rule traces to the FTC's Toysmart action in 2000, and it reappeared in the RadioShack case (2015) and in the 23andMe bankruptcy (2025), where the FTC's chairman wrote that any buyer must honor the company's privacy representations.

A disciplined diligence review asks for every version of every policy and notice for the full lookback period; the data map and vendor list; consent records for the data being acquired, especially sensitive data and data used for model training; the tag and SDK inventory with a fresh network capture; regulator correspondence and demand letters; rights-request metrics; and the corporate-transaction clause in the policy itself. The deal documents should then carry specific representations (compliance with posted policies and applicable law, no material retroactive changes without consent, rights to transfer and use the data as the buyer plans), a special indemnity for known tracking exposure, and a post-closing plan that honors old promises for old data. See Representations, Warranties, and Indemnification in Acquisition Agreements: Where the Money Actually Moves and IP Due Diligence Checklist for Mergers and Acquisitions: A Practical Checklist.

Costs and practical realities

Drafting a policy is the cheap part. The expensive parts are learning the facts and changing them.

Exposure is measured differently. FTC civil penalties for rule or order violations exceed $50,000 per violation after annual inflation adjustments, which is why a company already under an order (Facebook, Twitter) pays nine and ten figures. The CCPA authorizes $2,500 per violation and $7,500 per intentional violation or violation involving a minor, both now adjusted upward for inflation. Statutory damages in private suits multiply by class size: $1,000 or $5,000 per BIPA violation, $5,000 per California wiretap violation, $2,500 per VPPA violation under 18 U.S.C. § 2710(c), $10,000 or $100 per day under the Wiretap Act, and $500 to $1,500 per TCPA call. Defense costs through a motion to dismiss in a pixel class action commonly run well into six figures, and the timeline from demand letter to resolution is typically one to three years. Against that, a quarterly network capture costs very little.

Common mistakes

1. Copying a competitor's policy. It describes their systems, not yours, and Stride Collective's policy shows how that ends.
2. Saying "we do not sell" while running advertising pixels. In California that is "sharing," and in several states it is a sale.
3. Treating the policy as consent to recording that starts on page load. Javier requires prior consent; the banner must come first.
4. Running a decorative banner. If tags fire regardless of the choice, the banner is evidence against you.
5. Ignoring Global Privacy Control. It is a legally effective opt-out under the CCPA and several other state laws.
6. Retention by platitude. "As long as necessary" is not a period or a criterion.
7. Changing purposes retroactively. New uses of old data, including model training, require consent.
8. Losing old versions. Popa shows what happens when the company cannot prove what its policy said.
9. Renaming documents without updating cross-references. In re Facebook Internet Tracking turned on exactly that.
10. Letting the help center, app store labels, and sales decks drift. The most specific statement is the one that gets quoted.
11. Promising outcomes instead of describing controls. "Your data is safe with us" is a security guarantee nobody can keep.
12. Treating health-adjacent data as ordinary data. GoodRx, BetterHelp, Washington's health data law, and the Health Breach Notification Rule all say otherwise.
13. Burying statutory consents in the policy. TCPA written consent, VPPA consent, BIPA releases, and HIPAA authorizations each need their own instrument.

Three worked examples

A fitness app: Stride Collective, continued

Return to the opening. Stride's policy says "we never share your health data with third parties," and three advertising and analytics tools receive workout types, weight entries, and hashed email addresses on every logged session.

The exposure. Under Section 5, the sentence is false, and hashing does not help: BetterHelp's order treated hashed identifiers sent alongside health context as health information. If the app draws data from more than one source (manual entries plus a connected wearable, for example), Stride is likely a vendor of personal health records under the Health Breach Notification Rule as amended in 2024, and an unauthorized disclosure to advertising platforms is a "breach of security" that triggers notice to users and to the FTC within 60 days of discovery. Weight and workout data are likely "consumer health data" under Washington's My Health My Data Act, which required separate consent to collect and to share. In California the transfers are "sharing" of sensitive personal information, with no opt-out link and no right-to-limit link. Private plaintiffs would add wiretap claims; in 2025 a federal jury in San Francisco found Meta liable under California's eavesdropping statute for receiving Flo Health users' reproductive data through an SDK, years after the FTC's 2021 order against Flo.

The response. First, stop the transmissions: disable advertising events on logged-in screens, strip health parameters, and route any remaining events through a server-side integration with an allowlist of fields. Second, preserve the tag manager history, SDK versions, and policy versions, because a demand letter is likely. Third, analyze notice duties under the Health Breach Notification Rule and state law with counsel; a rewrite of the policy does not cure a past disclosure. Fourth, rebuild the notices: a notice at collection on the onboarding screen, a just-in-time consent for any health data use beyond the core service, a corrected app store label, and an accurate policy. Fifth, ask the platforms to delete the data received and confirm their contractual use restrictions. Sixth, do not apply the new policy to past data without consent, and brief the board.

A B2B SaaS company: Ledgerline

Ledgerline sells invoicing software to small businesses, and its customers upload their own clients' names, addresses, and payment histories.

Two roles, two documents. For uploaded customer data, Ledgerline is a processor (a "service provider" in California) acting under a data processing agreement; the customer's own privacy policy governs what the customer's clients were told. For its website visitors, sales leads, account administrators, and product telemetry, Ledgerline is a controller, and since January 1, 2023 the CCPA has covered business contact data fully. The policy must say both things: what Ledgerline does with its own data, and that customer data is processed under customer instructions and the agreement, not under the policy. Kuhns shows the value of an explicit priority clause when two privacy documents could apply to the same data.

The AI feature. Product wants to train a cash-flow forecasting model on all customers' invoices. The policy and the agreement both say customer data is used "only to provide the services." Training a shared model is a new purpose. Ledgerline needs contract amendments with customers, prospective notice, and, for any data already collected, consent that the customer is in a position to give. The FTC's 2024 warning about quietly changed terms is aimed squarely at this move, and the Everalbum line of orders means a model trained on improperly used data may have to be deleted. Ledgerline should also keep its published subprocessor list and its security page consistent with the policy, because enterprise buyers and their lawyers will read all three together.

An e-commerce store adding a loyalty program: Harbor & Pine

Harbor & Pine, an online home-goods retailer, launches "Harbor Rewards": points for purchases, birthday discounts, and partner offers from other brands.

California. Because the program offers a benefit in exchange for personal information, Harbor & Pine must give a notice of financial incentive before enrollment (Cal. Civ. Code § 1798.125(b); Regs. § 7016), describing the material terms, the categories of data involved, how to opt in and withdraw, and a good-faith estimate of the value of the consumer's data with the method used (Regs. § 7081 lists acceptable methods). Enrollment must be an affirmative opt-in. Partner offers that depend on sending purchase histories to other brands are a sale or sharing, which requires the opt-out link and accurate disclosure, and purchases that reveal sensitive facts (a pregnancy test, mobility aids) raise sensitive-data questions.

Elsewhere. Most state laws allow bona fide loyalty programs but restrict selling loyalty data to third parties, and Colorado's rules add loyalty-program disclosures of their own. Text-message enrollment needs a separate TCPA consent that is not a condition of joining. The old purchase history is the trap: using it to compute a member's tier is a compatible purpose, but sending past purchases to partners was never disclosed, so the partner program should start with data collected after enrollment unless members agree otherwise. The policy, the notice at collection on the sign-up form, and the program terms should be updated and archived together.

Frequently asked questions

Does every business need a privacy policy? Any commercial website or app that collects personally identifiable information from California residents must post one under CalOPPA, and almost every site has California visitors. Sector laws (COPPA, GLBA, HIPAA) require their own notices, app stores and advertising platforms require a policy by contract, and silence is not a safe harbor from the FTC, which treats undisclosed surprising practices as omissions.

Can we use a template or a policy generator? For structure, yes. For facts, no. A template cannot know which pixels run on your checkout page, and the FTC does not care where a false sentence came from.

Is a privacy policy a contract? Sometimes. It depends on whether the terms of service incorporate it, whether its statements read as promises, and whether the user assented. Regardless of contract law, its statements are enforceable as representations under the FTC Act, CalOPPA, and state consumer protection statutes.

Do we need consent to change our policy? Prospective changes need advance notice that existing users actually receive. Material changes applied to data you already collected need affirmative express consent. GLBA, HIPAA, and COPPA have their own change procedures.

Does our privacy policy give us consent to use pixels or session replay? Only if a reasonable user reading all of your disclosures would understand the specific practice before it happened. Under all-party consent statutes, the consent must come before recording begins, which a policy linked in the footer rarely achieves.

We don't sell data for money. Can we say "we do not sell your data"? Not without qualification. California treats disclosure for cross-context behavioral advertising as sharing, and several states define sale to include exchanges for other valuable consideration. Use the statutory terms and describe what you actually do.

How often should we update the policy? At least every 12 months (California requires it) and whenever a trigger occurs: a new vendor or SDK, a new data category, a new purpose, a new jurisdiction, or a transaction.

A company's practices don't match its policy. What can a consumer do? Turn on Global Privacy Control, use the opt-out links, submit an access or deletion request, and file complaints with the FTC and the state attorney general (and in California, the California Privacy Protection Agency). Private lawsuits are available under some statutes, and a lawyer can assess whether the facts fit one.

Practical takeaways

• A privacy policy is a set of factual claims, and every regulator and plaintiff reads it that way.
• Build the policy from the data map, the vendor list, the tag inventory, and the retention schedule; if those do not exist, start there.
• Use statutory vocabulary ("sale," "sharing," "sensitive," "de-identified") and say exactly what you do.
• Keep sector notices and statutory consents (TCPA, VPPA, BIPA, HIPAA, COPPA) in their own instruments.
• Make tracking, replay, and chat recording wait for a real choice, and honor Global Privacy Control.
• Treat help center pages, app store labels, and product-specific notices as part of the policy; the most specific statement controls.
• Get affirmative consent before applying a material change to data already collected, including for AI training.
• Archive every version with screenshots and keep consent records that show what each user saw.
• Audit at least annually by comparing the policy to a live network capture.

For the step-by-step process, see the companion Drafting and Maintaining a Privacy Policy: A Practical Guide; for a line-by-line review, the Privacy Policy Drafting and Review Checklist: A Practical Checklist; and for model language, consent flows, and change records, the Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: the comprehensive state laws whose notice rules shape the modern policy.
• Tracking Pixels, Session Replay, and the Wiretapping Lawsuits Reshaping Adtech: the litigation that tests policies against network traffic.
• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: notice and parental consent for children's services.
• Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration: when users are bound by the terms that incorporate a policy.
• Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule: manipulative design rules beyond privacy.
• Biometric Data Privacy Laws and Their Impact on AI Development: BIPA and the other biometric notice-and-consent statutes.
• Cybersecurity Regulation for Businesses: The FTC Safeguards Rule, NYDFS Part 500, SEC Cyber Disclosure, and State Laws: the security duties behind a policy's security statements.

Related Guides

• Drafting and Maintaining a Privacy Policy: A Practical Guide: the step-by-step companion to this article.
• Developing a Privacy Compliance Program: the program a policy sits inside.
• Auditing Your Website Tracking Stack: A Practical Guide: how to capture and reconcile what your site actually sends.
• Data Minimization and Avoiding the Over-Retention of Personal Information: building the retention schedule the policy must describe.
• Legal Issues for Mobile Applications: Privacy: app permissions, SDKs, and store requirements.

Related Checklists

• Privacy Policy Drafting and Review Checklist: A Practical Checklist: a line-by-line review tool for drafts and existing policies.
• Website Tracking Compliance Checklist: A Practical Checklist: phase-by-phase tracking review.
• Data Subject Rights Request Handling Checklist: A Practical Checklist: making the rights section of the policy true.

Related Toolkits

• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: model clauses, consent language, and version records.
• Adtech Privacy Toolkit: Tag Inventories, Consent Records, and Litigation Defense: inventories and consent logs for advertising technology.
• Privacy and Data Protection Toolkit: Building and Running a Privacy Program: program documents that support the policy.