You're not writing a privacy policy. You're checking whether the one on a site or app matches the product before you give up an email, a card number, or a location permission.
That public page should name what the company collects, why it uses the data, who else gets a copy, and how you can object. Most people never finish it.
Do you need every legal paragraph? No. Know which lines matter, which U.S. rules sit behind them, and where to go if the page is missing or a request sits unanswered.
What U.S. rules actually require
Thing is, the United States does not have a single federal law that forces every website to publish a privacy policy.
The Federal Trade Commission can treat a false or misleading privacy statement as an unfair or deceptive practice under Section 5 of the FTC Act. A lie in the policy can still be a federal problem.
If a company says it does not sell your data and then ships it to advertisers, that gap can be a federal issue even when no state privacy statute applies.
California sets a higher bar for many businesses. Covered businesses must keep a privacy policy and give a notice at or before collection under the California Consumer Privacy Act. The CPRA changes took effect on January 1, 2023.
Coverage depends on revenue, how many California residents' records the business handles, or whether it sells or shares personal information. A tiny hobby site with almost no California traffic may sit outside that law. A retailer, app, or ad-funded service that reaches California often does not.
Kids add another federal layer. If a site or app is directed at children under 13, or it has actual knowledge it collects their personal information, the COPPA Rule applies. The FTC explains those contents in its COPPA compliance guidance.
What to scan for in a few minutes
You don't need a 20-page read. Search the policy for a few words and see whether the answers are specific.
| Search for | What a useful answer looks like |
|---|---|
| Collect, categories, personal information | Names real data types: email, location, purchase history, inferences |
| Sell, share, disclose | Says whether advertisers, analytics firms, or data brokers get anything |
| Rights, request, opt out | Gives a form, email, or "Do Not Sell or Share" link you can actually use |
| Cookies, tracking, pixels | Lists analytics or ads tools instead of a vague "may use cookies" line |
| Children, under 13, COPPA | States whether the service is for kids and what is collected from them |
| Contact, privacy@ | Provides a reachable address, not a dead form |
Some companies bury the useful part under a heading for California residents. Scroll there if you live in California or another state with a similar law. The labels differ.
The questions stay the same: what did they take, who got it, and how do you stop the sale or sharing.
A copied template that never names the actual analytics vendor or ad network is a weak signal. Payment processors belong on that list too. You want names.
Rights California law actually describes
If the business is covered by California's law, the Attorney General's materials describe rights that include:
- Knowing what personal information was collected, sold, or shared in the preceding 12 months
- Asking for deletion or correction
- Opting out of sale or sharing, including through a user-enabled Global Privacy Control (GPC)
- Limiting some uses of sensitive personal information
- Receiving equal service if you exercise a right
The California Attorney General's office states that a business must wait at least 12 months before asking you to opt back in after you opted out of sale or sharing. A supporting browser can send a GPC opt-out.
Before some private CCPA lawsuits, you must give the business written notice of the sections it violated and allow 30 days to respond that it has cured the violations. That notice process is about private lawsuits. It isn't the same as a complaint to the Attorney General.
Other states have their own privacy statutes. They aren't carbon copies of California's, so a California "Do Not Sell" link is not automatic coverage everywhere. Check any state-specific section the policy includes if you live outside California.
If a child under 13 can use the service
COPPA is narrower than a generic privacy page. It's also stricter. A service directed at children under 13 has to post a policy that names every operator collecting personal information.
It also has to describe what is collected, how it is used, and which third parties (ad networks, social plug-ins) collect children's information through the service.
Turns out a mixed-audience app can still collect data from users under 13 even when the marketing is aimed at families. Parents should look for that third-party list. A policy that claims the company collects nothing from children, while the app is clearly built for kids, is a warning sign.
The FTC enforces COPPA, not a template generator.
When the writing does not match the product
You add something to a cart, a pixel fires in the background, an email later shows up from a brand you never typed into a form, and the policy still says the company does not sell personal information, which is exactly the mismatch that makes a dated screenshot more useful than rereading the same paragraph three times.
Sharing with advertising partners can count as a "sale" or "share" under California's definitions. That's why covered businesses post a "Do Not Sell or Share My Personal Information" link.
If the live site uses extra trackers or SDKs the policy never mentions, save screenshots and note the date. Form fields that never appear in the policy are worth capturing too. You don't need a legal file.
A dated screenshot and the policy URL are enough to start a complaint.
How to submit a request, then escalate
Open the policy from the footer, the app settings, or the account menu. Copy the URL and the "last updated" date, yes both, because you'll want the version you actually read.
- Use the "Do Not Sell or Share," "Your Privacy Choices," or request form if one exists. A GPC-enabled browser can send the opt-out on sites that honor it.
- If there is only an email, write from the address on the account. Say whether you want access, deletion, correction, or an opt-out. Keep the reply.
- Watch any response window the policy publishes. If they stall, send one follow-up with the original date.
- California residents who get no real answer on a covered request can use the path on the CCPA page. Anyone in the U.S. can raise a misleading privacy claim with the FTC, starting from its privacy and security guidance.
- Your state attorney general may take privacy complaints too. Search that office's consumer page rather than a random form mill.
To be honest, most people never save the page they relied on. Do it once for an account you actually use.
If the company is based in the EU or clearly targets EU residents, you may also see a GDPR-style notice that lists a lawful basis and extra rights such as erasure. That's a separate regime from U.S. state law. GDPR.eu's privacy notice explainer is a plain-language overview of what those EU notices are supposed to contain. It doesn't replace California or FTC rules for a typical U.S. shopping or app account.
Pick one account this week. Search its policy for sell, share, delete, and children. If you live in California and the opt-out link is missing, that fact alone is worth keeping.