A privacy policy is a company's public promise about what it collects and what happens to your data afterward. That promise matters in two directions. It tells you what you're entitled to know, and it becomes the yardstick regulators use when the company's real practices don't match the paperwork. So the useful questions are narrow: what must the document actually disclose, which rights can you enforce yourself, and where do you complain when a company stonewalls?
Jurisdiction comes first, because the answer shifts with where you live. In the United States, three layers do most of the work: the FTC's ban on unfair and deceptive practices nationwide, California's CCPA for California residents, and targeted rules like COPPA for children's data. GDPR protects people in the EU and UK. It doesn't hand rights to U.S. residents, so don't build a complaint on it. And if you landed here hoping for drafting templates, this is the other half of the document: what it means for the person reading it.
Which rules actually cover you
| Rule | Who it covers | What it means for you |
|---|---|---|
| FTC Act, Section 5 | Consumers in every state | A policy that misstates data practices can be treated as deception |
| CCPA/CPRA (California) | California residents | Rights to know, delete, correct, and opt out of sale or sharing |
| State laws, e.g. Colorado's | Residents of states that pass them | A notice listing data categories, purposes, and your rights |
| COPPA | Children under 13 | Verifiable parental consent required before collection |
| GDPR | People in the EU and UK | A separate regime; not the basis for a U.S. complaint |
Coverage has edges. California's law reaches for-profit businesses above certain revenue, data-volume, or data-sale thresholds, so some small companies fall outside it. The FTC's rules don't care about size. The California Attorney General's CCPA overview explains how the thresholds and rights fit together.
What the policy has to tell you
California gets specific about disclosures. A covered business must use its privacy policy to spell out the categories of personal information it collects, the purposes, the categories of third parties that receive it, and your rights with instructions for using them. The state's regulations also expect a visible date and a review of the policy at least once every 12 months. This summary of U.S. privacy policy requirements walks through the statutory language.
When you open any policy, hunt for five things:
- What's collected: real categories like contact details, location, or browsing history, not just "data"
- Why: purposes tied to those categories rather than a catch-all
- Who gets it: third-party categories, and whether data is sold or shared for advertising
- How long it's kept: retention periods, or at least the criteria used to decide
- Your rights: plus the exact channel for submitting requests
If one of those is missing or foggy, that's information too. And if a service is aimed at children under 13, federal COPPA rules add a gate: verifiable parental consent before collection happens, so the notice should say so plainly.
Red flags to catch while reading
Some phrases deserve suspicion. Thing is, vague language usually isn't accidental.
- "We may share information with trusted partners" with no categories named
- No retention periods anywhere in the document
- No effective or last-updated date, or a date that hasn't moved in years
- No contact method for privacy requests
- A full list of GDPR rights for EU users and silence about rights where you live
If you're in California
California residents hold the strongest hand: rights to know, delete, correct, and opt out of the sale or sharing of personal information. Here's the working sequence.
- Look for a "Do Not Sell or Share My Personal Information" link. Businesses that sell or share data have to post one, and after you opt out they must wait at least 12 months before asking you to opt back in.
- Turn on a global privacy control signal if your browser offers one. Businesses selling or sharing data have to respect that signal as an opt-out.
- Send know, delete, or correct requests through the web form, email, or toll-free number listed in the policy. Businesses must confirm receipt within 10 business days and respond within 45 days, according to the state's guidance on submitting privacy requests.
- Expect deletion to travel. The company must also tell the service providers and third parties it shared your data with, so they follow the request too.
The term "sale or sharing" reaches further than most people guess. In 2022, California's attorney general settled with Sephora for $1.2 million in a case where data sent through the retailer's tracking pixels counted as a sale even though no money changed hands, as this explainer on website privacy obligations recounts. A policy that says "we never sell your data" while ad trackers run on every page is exactly the mismatch enforcers look for.
If you live somewhere else
Don't tune out. The FTC can act in any state when a policy misrepresents how a company handles data, because a misleading privacy statement falls under the ban on deceptive practices; the agency's business guidance on privacy and security lays out that position. Other states keep adding their own notice requirements, Colorado's among them, so your attorney general's site is worth a check. Reading from the EU or UK? GDPR controls there, and that's a different playbook.
When a company ignores its own policy
Start with evidence. Save a dated screenshot of the policy, a copy of your request, and any reply you get. Put requests in writing even when a phone number exists, because regulators ask for the paper trail later. Under California's law, a private lawsuit over a data breach also starts with written notice identifying the violated sections and a 30-day window for the business to fix the problem.
Where to take a complaint:
- California Attorney General, for CCPA violations
- California Privacy Protection Agency, which enforces the state's rules; its FAQ covers request timelines and rights
- FTC, for a policy that looks deceptive
- The CPPA's DROP tool when the problem is data brokers: one request covers every broker registered with the agency
That last one matters more than it sounds. Data brokers package and sell information you never handed to them directly, and DROP exists to reach them in a single shot.
Quick answers
Does a privacy policy give me my rights? No. Statutes do. If a policy skips a right you hold under California law, you still hold it. The policy is still a binding promise, though, and breaking it can trip the FTC's deception rules.
I'm not in California. Is the policy useless to me? Not useless. The FTC covers misleading policies everywhere, several states now require their own notices, and the document tells you what the company admits to doing with your data. To be honest, that last part is the quiet value of reading one at all.
How do I get off data broker lists? In California, use DROP through the Privacy Protection Agency. Elsewhere, check whether your state runs something similar; if not, it's broker-by-broker requests.
Where to start
Pull up the policy of one app or account you actually use. Check three things: the last-updated date, the sell/share opt-out link, and the contact for requests. If something's missing, send one short written question asking how the company shares your data. The answer, or the silence, tells you where you stand.