Is your privacy policy telling the truth?
The short version
- Your privacy policy is a public promise about what your website does with visitors' information.
- Analytics tools, advertising pixels, chat widgets and embedded videos can collect and share data your policy doesn't mention.
- Check what your site actually loads, compare it with what your policy says, and fix whichever one is wrong.
- If your site has a "Reject all" button, make sure it really stops the tracking.
Why policies drift
Most privacy policies are written once, often from a template, and then forgotten. Meanwhile the website keeps changing: a marketing agency adds an advertising pixel, someone installs a chat widget, a video gets embedded. Each of these can send information about your visitors to other companies, and none of them update your privacy policy for you.
Why it matters
A policy that says "we never share your information" while advertising tags send visitor data to third parties is a misleading promise. Regulators such as the Federal Trade Commission treat broken privacy promises as deceptive practices, and businesses in health care and other sensitive fields face extra scrutiny. In California, the state's privacy law requires covered businesses to honor opt-out signals such as Global Privacy Control.
Check your own site
- Read your policy and write down what it promises: what you collect, who you share it with, whether you "sell" or "share" data, and any cookie choices you offer.
- List what your site actually loads: analytics, advertising and social media pixels, tag managers, chat tools, embedded videos and maps, and booking or payment widgets. Your web developer or marketing agency can tell you what they've added.
- Compare the two. Every tool that collects or shares visitor data should be described in the policy, and anything you no longer use should come off the site.
- Test your cookie banner, if you have one. After clicking "Reject all," trackers should stop loading. A browser's developer tools can show which services a page contacts.
- Look closely at sensitive pages. Contact forms, appointment requests and anything health- or finance-related shouldn't feed advertising tools.
Fix the right thing
Sometimes the policy is out of date and needs rewriting. More often, the site is doing more than the business intended, and the right fix is to remove or reconfigure a tool. Either way, the goal is a policy that describes your site accurately.
More Security Notes
-
Texts, calls and voices you shouldn't trust
Fake toll and delivery texts, calls from "your bank's fraud department," and AI-cloned voices: how they work, and one call-back rule that defeats them all.
-
Do you need a written security plan?
What a written information security plan is, which businesses are required to have one, Ohio's safe harbor, and what belongs in the plan.
-
Stop criminals sending email as you
Three DNS records, SPF, DKIM and DMARC, decide whether criminals can send convincing email from your domain. Here is what each one does and how to set them up.
-
Turn on two-step login everywhere
The most effective step you can take this week: which accounts to protect first, which kind of second step to choose, and how to roll it out to your team.
-
Spot phishing and fake invoice scams
How today's phishing really looks, the change-of-bank-details scam that targets small businesses, and a simple payment rule that stops it.
-
Password managers for small teams
Why reused passwords are the real risk, how a password manager fixes it, and how to move a small team off the shared spreadsheet.