What is Privacy Policy?

The privacy policy is where transparency obligations converge. GDPR Articles 13 and 14 prescribe the notice content in detail: the controller's identity and contacts, the purposes and legal basis of each processing operation, legitimate interests where relied on, recipients, international transfers and their safeguards, retention periods, the full catalog of data subject rights, withdrawal of consent, complaint rights, and the existence of automated decision-making. California layers on its own list: categories collected, sold, or shared in the last 12 months, the purposes, consumer rights, and how to exercise them — with an annual update requirement.

It is also a liability document. The FTC's core privacy authority polices deception, and the fastest route to a deceptive-practices case is a policy that says 'we never share your data' while the site syncs audiences to ad platforms. Class actions quote policies back at their authors; regulators diff them against scan results. The cardinal rule is that the policy must describe what actually happens — which means it depends on knowing your data flows, and it must change when they do.

Format matters legally: notices must be concise, transparent, intelligible, and in clear and plain language. Layered policies — a readable summary above the detailed disclosures — are the accepted pattern. Boilerplate copied from another site fails in both directions: it discloses processing you do not do and misses processing you do.

Adjacent documents orbit it: cookie policies detailing trackers, CCPA-specific notices at collection, and — for stores — regionally tailored disclosures that track where you actually sell.