Google Answers Logo
View Question
Q: Is a website privacy policy required ? ( Answered 4 out of 5 stars,   3 Comments )
Subject: Is a website privacy policy required ?
Category: Miscellaneous
Asked by: progressman-ga
List Price: $40.00
Posted: 05 Feb 2006 21:35 PST
Expires: 07 Mar 2006 21:35 PST
Question ID: 441975
A friend is starting a web site design business. He has design and
marketing talent no no legal expertise.

1) What type of websites are required to have a privacy policy? 
2) I found several privacy policies for sale on sites that sell legal
forms, are there any of those types of companies considered reputable?
3) If a web site does not have a privacy policy what are the penalties? 
4) Would the designer face penalties or just the web site owner? 
5) Are there any cases where a site owner or designed got into legal
or civil problems or penalties due to lack of a policy?
6) If the designer purchased the domains and hosting for clients in
the designers name will this change anything?

I will a tip for a detailed answer.
Subject: Re: Is a website privacy policy required ?
Answered By: siliconsamurai-ga on 06 Feb 2006 08:39 PST
Rated:4 out of 5 stars
Hi, thank you for bringing your question to Google Answers.

I?ll begin by summarizing the answer, then fill in the details. You
have a lot of questions but the basic answer is pretty simple.

There are some very scary sounding laws regarding the Internet but the
important thing to remember is that very few people get into trouble
and those are almost always people with actual criminal intent. Mere
mistakes usually won?t get you into trouble with the criminal law
unless you do something such as intentionally disclose someone?s
private information such as a social security number. Being criminally
negligent in designing a Web site is difficult to prove in court,
although I would avoid designing Web sites which collect any personal
health or financial data or which make them available through some
sort of search (even if encrypted.)

Civil action is always possible about absolutely anything. Just check
any of the entertainment court shows on TV and you will see that it is
possible to get sued over virtually anything.

The simple way around this is to incorporate the design business ?
that way, unless the people involved are intentionally doing something
blatantly illegal, their private assets are protected (in the U.S.). A
corporation is legally an individual under the 14th Amendment to the
Constitution, capable of engaging in business, signing contracts, and
being sued. But the owners of the corporation are MOSTLY immune to
criminal or civil action.

That is my major piece of advice ? if the person designing Web sites
has any assets of their own, don?t go into that (or almost any)
business without incorporating. It is cheap insurance.

What brought about all this concern over Web site Privacy Policies was
the release of Internet Explorer 6 which included a way to quickly
check a site?s privacy policy. (Look in the View pull down menu for
Privacy Report.)

This relates to the P3P Platform for Privacy Preferences standard. If
you do have a privacy policy for a Web site you should definitely
comply with the P3P guidelines. (More on P3P below)

Most sites only use a privacy policy as a marketing tool so it only
makes sense if your clients are going to look for it.

>Is a Web site privacy policy required?


In fact, there are virtually no regulations relating to Web sites. The
Internet is still the wild, wild west of marketing and commerce,
although that is slowly changing as governments begin to regulate the
Web more closely.

Unless you fall into some very narrow categories such as a U.S. based
medical services company or a financial institution with fiduciary
responsibilities, what a visitor puts on your Web site is considered
public information.

In this instance, your friend?s site advertising his/her own Web
design service has no particular obligations to protect privacy of

However, being in the Web site design business he(or she) also needs
to know about any special needs his(her) clients have which are
imposed either by industry custom or law. I address that below.

However, IF you do post a privacy policy, then you could very well be
held liable for any violations ? that is one reason I never post a
privacy policy on any of my sites. I never collect or share
information about visitors but just stating that could open me up to
legal problems if some hacker penetrated the servers which host my
various sites. I have my own very strict internal privacy policy, but
it isn?t published on any of my Web sites.

For most businesses the purpose of a privacy policy is to tell your
users what you will do to protect their privacy. Whether it will be a
liability not to have a posted privacy policy is very much dependent
on just what the Web site does and who your visitors are.

I?ve never had a single question from many, many thousands of visitors.

> Is it necessary to have a privacy policy?

There is a difference between having a privacy policy and posting a privacy policy.

>What types of sites require a privacy policy?

Some health-related sites are required under HIPAA or other laws to
protect any confidential information collected.

This includes hospitals, pharmacies, doctors, and even insurance companies.

Any such company having a site designed will know about their privacy
policy obligations and the site designer should place the burden on
them in their contract.

Some states, such as California, make it a crime for anyone doing
business with even one person in California to disclose private
information and fail to notify that person quickly. It isn?t the
disclosure that is illegal, but the failure to notify.

This, however, doesn?t necessarily impose any requirement to post a
privacy policy. You need to consult an atty. About that ? the owner of
the site you are designing should certainly be aware about any legal
requirements they are under to post a policy and a Web site designer
should include something to that effect in their contract.

Any site which collects private information about individuals can
place the owner (and possibly the designer) in danger of being sued
and perhaps even prosecuted if they expose data which can be used in
identity theft.

I wouldn?t buy a privacy policy, although many of the sites which have
them for sale are reputable enough. The real problem is that this is
an area of legal limbo and, until a lot more case law is decided, no
one really knows what constitutes a good privacy policy.

To decide, I suggest you ask the vendor of a privacy policy just how
much they guarantee that it will stand up to legal challenge. My
suspicion is that none of them will offer any sort of solid guarantee.
If you decide to post a policy I would check with a good lawyer.

>What are the penalties for not having a policy?

None unless a particular State imposes a policy requirement on some kinds of sites.

>Would the designer face penalties, or just the owner?

Well that depends on a lot of factors. For example, if sloppy
programming or design caused information to be hacked then the owner
of the site could certainly have a civil case against the designer.
That should be addressed in the contract which must be signed before a
design project begins. Again, this has nothing specifically to do with
a posted or even unposted privacy policy.

>Are there any cases where owner or designer got into problems?

Absolutely! California in particular is always bringing cases against
companies and individuals. But considering the scale of the Internet,
this is actually very rare.

But I don?t know of any legal problems actually related to the lack of
a policy, only to fraud or violation of privacy and those laws apply
whether there is a policy or not, although a well-written policy
passing all responsibility to the site visitor might be helpful if it
is very carefully drawn up by a good lawyer.
Here is the California Atty. General?s main page because California is
often in the forefront of these laws.

There are issues to do with the CANSPAM act

which actually specifies HOW you can spam people legally.

Issues surrounding age and particular care in protecting the
information about children.

Issues of protecting privacy or customers and vendors for commerce sites.

Because laws are always changing, you should monitor

Which is the Department of Justice?s Cybercrime home page.

You will find some intellectual property and privacy notes at

and some more food for thought at

Medical Privacy
Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Fact sheet for protecting patient privacy

Financial institutions

U.S.C. Title 15, Chapter 94, Subchapter I, Sec. 6801 covers the
Gramm-Leach-Bliley Act (he Financial Modernization Act of 1999.) This
act imposes privacy legislation on financial institutions by
regulating protection of nonpublic personal information.

This would only apply if he is designing Web sites for financial
institutions but that covers a lot more than just banks. In any case,
that doesn?t necessarily mandate a published privacy policy on the Web
site, just that data be protected. Again, protect against this in the

Creating a privacy policy

There is an online Privacy Statement Generator for Web sites at,2340,en_2649_34255_28863271_1_1_1_1,00.html

Organisation for Economic Co-operation and Development includes
special guidelines for various industries.

>P3P is a W3C standard, in other words, it is a voluntary standard
published by the WWW Consortium.

>If the designer held title to the site and URL (domain name) would
this change anything?

He or she needs to discuss this with a lawyer, but it shouldn?t make
any difference for most sites. I would certainly avoid owning the URL
or hosting site for any financial or medical-related Web site, however
the contract should shift any responsibilities either to the
contracting entity or the hosting business. Most hosting complaints
relate to outages and uptime anyway and your friend needs to make it
clear that they aren?t under his/her control.

Google Search Strings
prosecution of web site owner

When dealing with the law there are always open questions and about
all anyone can do is approach situations with an open mind and no
malice in their heart.

The best course of action is to first incorporate and then have a good
lawyer draw up a standard contract for the Web design business, one
which specifically absolves the designer of liability for almost
everything and, at a minimum, requiring the contracting company to
provide any required privacy policy text to include in medical or
financial sites.

This isn?t important so much because published privacy policies are
required for most, if any sites,(they aren?t) but because there could
always be new laws passed which would change the situation.

Unless you want to follow all new legislation in any country and state
where the clients do business, you have to protect yourself in writing
against this sort of thing ? as with HIPAA requirements, they will be
notified of any changes in the law affecting them or their sites.

Although you didn?t ask about this, I think I should point out the
Americans With Disabilities Act and the requirements it imposes on
companies to keep even Web sites accessible. This law is seldom

Although disability rights have mostly been ignored in the U.S. Web
sites do business internationally and the British have recently begun
to take this very, very seriously.

I hope this answered your questions, if you have a specific question
which you posted but believe has not been adequately addressed, simply
post a request for clarification and I will get back to you.

The bottom line is that if your friend has a well written contract
and, especially if they incorporate the Web design business, then they
should have no problems unless they actually have some criminal

Posting some sort of policy which isn't required is more likely to
cause problems than otherwise.

Clarification of Answer by siliconsamurai-ga on 14 Feb 2006 05:24 PST
Hi, thank you for the tip.

No need to reply.
progressman-ga rated this answer:4 out of 5 stars and gave an additional tip of: $5.00
very nice

Subject: Re: Is a website privacy policy required ?
From: jebediahtbone-ga on 05 Feb 2006 22:07 PST
As I understand it (I'm no expert) a privacy policy is not required.
They are used to give visitors a clear understanding of how their
personal information will or will not be used. It's more of an
informational/customer relations item than anything else.

That said, where they do come in hand is if your policy is to use a
visitor's information outside the use of your website (ie. selling it
to outside marketers). By having the policy, you basically tell users
that using your site constitutes acceptance of the sale of their
information. Thus, they can't come back and sue you for it later.

Again, I don't think it's legally REQUIRED to have a privacy policy,
but might make sense in order to limit your liability. Remember, even
if you win the law suite, you still incure hefty legal expenses.
Whatever you can do to prevent legal costs, is good.

I'm no expert. But this is my understanding.

Subject: Re: Is a website privacy policy required ?
From: star711-ga on 09 Feb 2006 08:04 PST
It is not required.....but, if you are asking for information from
your visitors, some will want to see your policy prior to filling in
any site forms. So, it's really no big deal to just add one.

For further domain name information, you may wish to visit:
Subject: Re: Is a website privacy policy required ?
From: siliconsamurai-ga on 10 Feb 2006 07:14 PST
True, it?s really no big deal to add one.

Unless of course you don't need one and:

>You make a minor mistake in the wording and create a legal guarantee
you can?t meet.

>You violate your stated policy and get sued.

>You later want to change your business and have to close the site
because you have a policy which doesn?t match your new business.


Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  

Google Home - Answers FAQ - Terms of Service - Privacy Policy