Does a small local business website legally need a privacy policy?

If your site collects any personal information - which a quote form or contact form does - the practical answer is yes. California's Online Privacy Protection Act, in effect since 2004, requires commercial websites that collect personally identifiable information from California residents to post a conspicuous privacy policy, and it has no revenue or business-size exemption. Because a website is visible in every state, a small business outside California is generally treated as in scope too. On top of that, the ad and analytics tools most owners already use require a posted policy under their own terms of service.

Can I copy a privacy policy from another website?

It is a bad idea for a specific reason: the disclosure requirement includes actually following the policy you post. A copied policy describes another company's data practices, so you end up publicly committing to things you do not do and describing collection you do not perform - shopping carts, shipping addresses, ad networks you never signed up for. That is worse than a short, accurate page. Copying also risks lifting someone else's copyrighted text. A plain page that honestly describes a quote form, an email inbox, and a web host is both easier and more defensible than a borrowed ten-page document.

What should a privacy policy for a service business actually say?

Six things, in plain language: who you are and how to reach you; what you collect (typically name, phone, email, address and job details from a quote form, plus automatic technical data like IP address if you run analytics); why you collect it (to respond to the request and do the work); who else sees it (your email provider, your web host, your analytics or ad tools, and any subcontractor who needs it for the job); what you do not do with it, including whether you sell or share it; and how someone asks you to delete their information. Add a last-updated date and link the page from the footer of every page.

RunCabin Blog · For working contractors

Does my small-business website need a privacy policy?

Q: Does the CCPA apply to my small contracting business?

Almost certainly not. California's CCPA, as amended by the CPRA, only applies to a business that meets at least one of three thresholds: annual gross revenue above roughly 26 million dollars (the original 25 million dollar figure is adjusted for inflation), handling the personal information of 100,000 or more California residents or households in a year, or making half or more of its revenue from selling or sharing personal information. A local service business with a few trucks is nowhere near any of them. Most other state privacy laws use similar volume-based thresholds. The law that does reach a small site is the older, simpler CalOPPA disclosure requirement.

August 22, 2026 · 7 min read

Short answer: yes, if your site has a quote form, a contact form, or any kind of analytics or ad tracking on it - which covers almost every trade website built in the last decade. But the reason is not the one most owners are worried about. The giant privacy laws that make the news do not apply to a two-truck operation. What does apply is an older, much smaller disclosure rule with no size exemption, plus the fine print of the tools you are already using. The good news is that the page itself is short, you can write it honestly in an afternoon, and nobody needs to sell you a subscription for it.

One note before anything else: this is a plain-English explanation from a website company, not legal advice. If you handle something unusual - medical information, background-check data on employees, kids' information - talk to a lawyer about your specific situation rather than a blog post.

What a privacy policy actually is

It helps to strip away the intimidating name. A privacy policy is not a contract, and it is not something anyone signs. It is a disclosure page: a public statement of what information your business collects from people who visit your website, why you collect it, who else ends up seeing it, and how someone can reach you about it. That is the whole job.

Which means the length of the page should match the size of what you actually do. The reason most privacy policies read like a mortgage document is that most of them were written for companies that run advertising networks, sell subscriptions, and ship physical products. A painting company with a homepage, a services page, a gallery, and a quote form is doing almost none of that. Your honest version is short, and short is fine.

Why "I'm just a small operation" does not get you out of it

The rule that actually reaches a small local website is California's Online Privacy Protection Act, usually shortened to CalOPPA. It has been in effect since 2004, long before the modern privacy-law wave, and it was the first state law in the country to require commercial websites to post a privacy policy at all.

Two things about it matter for you. First, it applies to any commercial website or online service that collects personally identifiable information from California residents - and a website does not have a state line around it, so in practice a business anywhere in the US is treated as in scope once a Californian can fill out its form. Second, and this is the part people miss, it has no revenue threshold and no small-business carve-out. Size does not exempt you the way it does under the newer laws.

CalOPPA also asks for two things beyond simply having the page: the policy has to be conspicuous, which in practice means a link in the footer of every page rather than buried somewhere, and you have to actually comply with what your policy says. Hold on to that second point, because it is the reason copying someone else's policy backfires.

Now, is the California Attorney General going to come after a three-person landscaping company in Ohio for a missing footer link? Realistically, no. That is not where enforcement attention goes. But the far more likely consequences are much closer to home.

The thing that actually bites: the tools you already use

For most local-service owners, the privacy policy requirement does not arrive as a lawsuit. It arrives as an account problem, because the platforms you rely on require one under their own terms and they check.

Google Ads. If you run ads, and especially if you run remarketing so your ad follows people who visited your site, Google's advertising policies require a privacy policy disclosing that data collection and the use of cookies by third-party vendors including Google. Missing or inadequate disclosure can get campaigns limited or an account suspended, and finding that out during your busy season is an expensive way to learn it.
Google Analytics. The terms you agree to when you install the tracking code require you to post a privacy policy disclosing your use of cookies and data collection. Most owners install the code because a marketer told them to and never read that part.
Meta and lead-form ads. Facebook and Instagram lead forms will not run without a privacy policy URL. The field is required in the form builder - a lot of owners meet this rule for the first time by getting stuck on it.
Business text messaging. If you send appointment reminders or quote follow-ups through a texting service, the carrier registration process that authorizes business texting generally asks for a link to your privacy policy along with a description of how you get consent to text. No policy, no approval.
Booking, payment, and form tools. Many scheduling widgets, online-deposit tools, and form services put the same requirement in their terms of use.

Notice the pattern. Every one of these is a gate you will hit while trying to get more work, not a lawyer's letter. That is the practical case for spending twenty minutes on the page now.

The law everybody panics about probably does not apply to you

When owners hear "privacy law" they usually mean the CCPA, California's big consumer privacy act as amended by the CPRA. It is worth knowing why you can stop worrying about it.

The CCPA only applies to a business that meets at least one of three thresholds: annual gross revenue above roughly 26 million dollars (the original 25 million dollar figure gets adjusted for inflation), handling the personal information of 100,000 or more California residents or households in a year, or making half or more of its revenue from selling or sharing personal information. A local service business is not close to any of those. Neither the revenue line nor the 100,000-people line is within sight of a company that does a few hundred jobs a year, and you are not in the business of selling data.

Most of the other state privacy laws that have passed since work the same way, keyed to large volumes of consumer records. So the honest summary is: the heavyweight laws are aimed at data companies and large retailers, and the rule that reaches your five-page site is the older, simpler, much easier one. Anyone telling you that a small contractor needs a paid compliance program to survive the CCPA is selling something. That is worth remembering the next time one of those unsolicited website and SEO calls opens with a compliance scare.

What to put on the page

Here is the honest skeleton for a local-service business. Write it in your own words, in the same plain voice as the rest of your site.

Who you are. Business name, service area, and an email address or phone number someone can use to ask a question about their information.
What you collect. Be concrete about the two kinds. From the form: name, phone number, email, service address, and whatever they typed about the job. Automatically: if you run analytics or ads, the technical data those tools gather, such as IP address, browser, and which pages were visited.
Why you collect it. To respond to the quote request, schedule and perform the work, and follow up about it. If you also send occasional emails to past customers, say so here rather than surprising people later.
Who else sees it. This is the part copied policies always get wrong. Your list is usually short and real: your email provider, your website host, your analytics tool, your ad platforms if you run ads, your scheduling or invoicing software, and any subcontractor who needs the address to do the job.
What you do not do. If you do not sell or rent customer information, say it plainly. For a trade business this line is not boilerplate, it is a genuine selling point, because a homeowner who filled out a form on a lead-generation platform has usually watched their phone number get handed to five other companies. Being able to say "your information goes to us and stays with us" is a real difference worth stating.
How long you keep it, and how to get it deleted. A simple statement that you keep job records for your business needs and that someone can email you to have their information removed is enough for most small operations - and it costs you nothing, since honoring that request is two minutes of work.

Add a last-updated date at the top, link the page from your footer so it appears on every page, and you have covered the substance of what the disclosure rule is asking for.

Two things not to do

Do not paste in another company's policy. Beyond the fact that you would be copying someone else's writing, remember the requirement to actually comply with the policy you post. A borrowed policy has you publicly promising to handle shopping-cart data, shipping addresses, and ad-network cookies you have never touched, and it describes retention practices you do not follow. A short accurate page is stronger than a long inaccurate one, and it is the one you can answer questions about.

Do not buy a monthly compliance subscription for a five-page brochure site. Those services exist and they are legitimate for companies with complicated data flows, multiple jurisdictions, and real legal exposure. A painter with a quote form is not that. Write the honest page, keep it current when something changes, and put the money into the truck.

Do you need terms of service too?

Less urgently. Terms of service govern the use of a site itself and matter most when people create accounts, buy something, or upload content. A brochure site with a quote form does not really need one. Where it starts to earn its place is if you take deposits or payments online, or if you publish pricing you want to qualify - and even then, what most owners actually need is clear language on the page itself about what a quoted price includes, not a separate legal document. Your job contract, the one the customer signs before you start work, is the document that matters for the work itself.

Where RunCabin sits

A RunCabin site is AI-editable, which is exactly the right shape for this job. Adding the page is one sentence: "add a privacy policy page for my business and link it in the footer." It gets written around what your site actually does - a quote form that emails you, a web host, and analytics if you are running any - rather than a generic template describing a store with a shopping cart. Read it, correct anything that does not match how you really work, and it is done. Keeping it accurate later is the same one-liner: "add the scheduling tool I started using to my privacy page."

The "what you do not do with it" line is also true by construction here. A quote request from your RunCabin site goes straight to your inbox, not into a pool that gets sold to three of your competitors, and there are no lead fees attached to it. That is a genuine sentence you get to put on your privacy page, and most of your competitors advertising on lead platforms cannot write it. Sites are $39.99 a month flat, no setup fee, no contract.

See a real preview of your site

Built for you with your name, your work, and your city - then add a privacy page just by asking. No setup fee. Sixty seconds, no card.

See your free site preview →