United States law generally. Requirements differ by state, and this page does not cover other countries except where a source says so.
This is a starting template, not legal advice, and using it does not create an attorney-client relationship. Requirements differ by state and by country, and some documents must be witnessed or notarized to be valid at all. Have a licensed attorney in your jurisdiction review anything you intend to rely on.
Page reviewed 2026-09-04 · rules current as of that review were not independently verified against every jurisdiction · next review scheduled annually
At minimum, what you collect, why you use it, who else sees it, and what rights people have. This generator walks those four in order — data collected, uses, third-party services, then compliance and user rights — because a policy that lists data without saying why it is collected answers only half the question.
They follow the user, not your address. GDPR covers people in the EU and CCPA covers California residents, so a site reachable from either can be in scope regardless of where it is run. This generator offers both as separate options, plus COPPA for children under 13 and a clause for international data transfers.
They add the disclosures for services that see your users' data on your behalf — analytics, payment processors, advertising networks, social plugins, email providers and hosting. Leaving one out does not make it invisible; it makes your policy incomplete about something that is already happening.
The page states it is a template for informational purposes and not legal advice, and recommends review by a qualified attorney. Treat it as a structure that makes sure you address the right topics, then check the specifics against the regimes you named.