Why Nearly Every Website Has to Tell You What It Does With Your Data

There’s no one law. There’s a pile of them.

Europe has GDPR, one law that applies to everyone. The US never passed an equivalent, so the requirement to publish a privacy notice comes from a patchwork:

• California’s CalOPPA (2004). Requires any commercial website or app that collects personal information from a California resident to post a privacy policy conspicuously. It applies no matter where the operator is located, and unlike the state laws we covered in why some companies don’t get a ‘delete my data’ button, it has no revenue or size threshold.
• Other states. Delaware and Nevada have their own website-notice laws, and the newer comprehensive state privacy laws (California’s CCPA, Virginia, Colorado, and others) require covered businesses to publish a privacy notice describing what they collect, why, and what rights you have.
• Sector laws. COPPA for sites aimed at children under 13, GLBA for financial companies, and HIPAA for healthcare providers each require their own specific notices.
• The FTC. No federal law says “you must have a notice,” but if a company makes privacy promises anywhere and breaks them, that’s a deceptive practice under Section 5 of the FTC Act. A notice is how those promises become visible, and how regulators know what to hold a company to.

This is a plain-English explainer, not legal advice. Which of these apply to a specific site depends on who it collects from and what it collects.

Why one California visitor is enough

CalOPPA’s reach is the reason the privacy notice became close to universal. A small shop in Ohio with a newsletter signup form doesn’t need a California office. It only needs one California resident to sign up. The internet doesn’t stop at state lines, so one large state’s rule quietly became the national baseline. In practice, enforcement against tiny sites is rare, but the obligation is real, and the safe assumption for any site that collects even an email address is that it applies.

Even where the law doesn’t reach, the platforms do

Plenty of sites are required to have a notice by contract rather than by statute. Google requires one before it will verify an app that asks for Gmail access, this one included. Google Analytics’ terms require disclosing that you use it. App stores, payment processors, email-marketing tools, and ad networks all make a posted privacy notice a condition of using their service. So even a site that could argue no law applies to it usually can’t actually operate without one.

A notice and a policy are two different documents

The outward-facing page is the notice: a plain statement to visitors of what’s collected, why, who sees it, and what rights they have. The policy is its internal counterpart: the rules a company’s own people and systems follow, like how long data is kept, who can access it, how a breach gets handled, and which vendors get vetted. One is a promise made to you. The other is how the company keeps it. A notice with no policy behind it is exactly the kind of gap regulators call deceptive.

A caution on vocabulary: the law isn’t consistent about the words. CalOPPA itself says “privacy policy” for the public page, many state laws say “privacy notice,” and countless sites label their public page “Privacy Policy.” The distinction is real and worth keeping even where the terms get tangled. ReclaimInbox calls its public page a Privacy Notice on purpose, and you can read it here.

What a good notice actually says

• What personal information is collected, and how (forms, cookies, analytics, inbox access)
• Why it’s collected and what it’s used for
• Who it’s shared with or sold to
• How long it’s kept
• What rights you have and exactly how to use them
• How to reach a real person
• When it was last updated

Format matters as much as content. A good notice uses plain words and short sentences, has clear headings you can skim, and doesn’t bury the important parts, like sharing or selling, under forty pages of legalese. CalOPPA requires it to be conspicuous: a real link people can find, not a gray line of tiny print. If you can’t understand it after reading it once, it isn’t doing its job.

Why this matters to you

Once a company publishes a notice, it becomes a promise regulators can hold it to. That’s what makes a notice more than a formality. If a company says it doesn’t sell your data and then does, that’s a complaint the FTC or a state attorney general can act on, the same kind of complaint we walk through on our CAN-SPAM page. And a site that collects your information with no notice at all is a red flag on its own.

A practical habit: read the part of a company’s notice that says who your data is shared with, then run the tracker check on that company from your IRM tab. If the notice says very little and the site is running a dozen ad pixels, that mismatch is worth knowing about. It isn’t proof of wrongdoing, since detected trackers are circumstantial, but it’s a good reason to ask more questions.