We share a tremendous amount of personal information online. From shopping and social media to banking, healthcare, mobile apps, and connected devices, companies may collect information about who we are, what we do, and how we use their services.
That makes privacy policies more important than ever.
A privacy policy explains how an organization collects, uses, shares, stores, and protects personal information. Privacy laws and regulations can also require organizations to provide specific information about their data practices or give people certain rights over their information.
As technology changes and consumers become more concerned about how their information is used, privacy policies and privacy practices continue to evolve.
What is a privacy policy?
A privacy policy is a document that explains how an organization handles personal information.
Depending on the organization and the applicable laws, a privacy policy may explain:
- What information is collected
- Why the information is collected
- How the information is used
- Whether information is shared with other organizations
- How long information is retained
- How information is protected
- What choices or rights people have regarding their information
- How people can contact the organization about privacy questions
You may encounter privacy policies when you create an online account, use an app, make a purchase, sign up for a service, apply for a warranty, or provide information to a business.
Privacy policies can be long and difficult to read, but the goal should be to give people meaningful information about what happens to their personal data.
Are privacy policies required by law?
Sometimes, but there is no single privacy law that applies to every organization and every type of personal information.
Privacy requirements vary depending on where you live, where a business operates, what type of information it collects, and what services it provides.
For example, the European Union's General Data Protection Regulation (GDPR) establishes requirements for organizations that process personal data of people in the EU. The GDPR includes principles such as transparency, purpose limitation, data minimization, storage limitation, security, and accountability. It also requires certain information to be provided to individuals in clear and understandable language.
In the United States, privacy requirements are spread across federal laws, industry-specific regulations, and state laws. For example:
- COPPA addresses the collection of personal information from children under 13 by covered websites and online services.
- HIPAA establishes privacy and security requirements for certain health information handled by covered entities and their business associates.
- The Gramm-Leach-Bliley Act (GLBA) includes privacy and security requirements for financial institutions.
- State privacy laws can provide consumers with additional rights. California's CCPA, for example, gives eligible California consumers rights related to knowing what personal information businesses collect and how it is used or shared, deleting certain information, and opting out of certain sales or sharing.
Because privacy requirements vary, businesses need to understand which laws and regulations apply to their specific activities.
Why are privacy policies changing?
Privacy policies change for several reasons, including new laws, changing technology, new business practices, security incidents, and growing consumer expectations.
Privacy laws continue to evolve
Governments around the world continue to develop privacy regulations as technology changes.
The GDPR is one of the best-known examples. Its requirements have influenced how organizations approach transparency, consent, data collection, retention, and individual privacy rights.
In the United States, state privacy laws have also become an increasingly important part of the privacy landscape. California's CCPA, for example, has given eligible consumers greater control over how businesses collect and use their personal information.
For businesses that operate across multiple regions, this can make privacy compliance more complicated because different laws may apply to different customers or types of data.
Consumers expect greater transparency
People increasingly want to understand what information companies collect and why.
A privacy policy should help answer basic questions such as:
What information are you collecting?
Why do you need it?
Who will you share it with?
How long will you keep it?
What choices do I have?
Privacy regulations increasingly emphasize transparency and meaningful information rather than simply hiding important details in lengthy legal documents. The GDPR, for example, requires privacy information to be presented in a concise, transparent, intelligible way and in clear language.
Technology keeps creating new privacy questions
New technologies create new ways to collect and process information.
Smartphones, connected devices, location services, biometric technologies, artificial intelligence, and other digital services can all introduce new privacy considerations.
Artificial intelligence is an especially important example. Organizations may need to consider what personal information is used by AI systems, how that information is processed, who can access it, and what privacy risks may result.
NIST's Privacy Framework is designed to help organizations identify and manage privacy risks, and NIST has been updating the framework to address newer privacy challenges, including AI-related privacy risks.
Privacy is about more than having a policy
A privacy policy is only part of a company's privacy program.
An organization can publish a detailed privacy policy, but it also needs processes and technology that support the practices described in that policy.
For example, organizations should consider:
- Collecting only the information they actually need
- Limiting access to personal information
- Protecting information from unauthorized access
- Retaining information only as long as necessary
- Providing appropriate choices and controls
- Training employees who handle personal information
- Reviewing how third-party providers handle data
- Responding appropriately to privacy and security incidents
The GDPR calls this approach data protection by design and by default. NIST also treats privacy as a risk-management activity rather than simply a legal document.
Privacy and cybersecurity are connected
Privacy and cybersecurity are not the same thing, but they are closely related.
Privacy focuses on how personal information is collected, used, shared, retained, and managed.
Cybersecurity focuses on protecting systems, networks, devices, and information from unauthorized access, disruption, alteration, or destruction.
A security breach can become a privacy problem when personal information is exposed. At the same time, an organization can have strong cybersecurity and still create privacy concerns if it collects more personal information than necessary or uses information in ways people do not expect.
That is why modern privacy programs increasingly consider privacy and security together. NIST's Privacy Framework is specifically designed to work alongside cybersecurity risk-management practices.
What should you look for in a privacy policy?
You do not have to read every word of a privacy policy to start understanding how a company handles your information.
Look for answers to these questions:
What information does the company collect?
Look for references to names, email addresses, payment information, location data, device information, browsing activity, or other personal information.
Why is the information collected?
A company should explain the purposes for collecting and using personal information. Data minimization and purpose limitation are important privacy principles under the GDPR.
Is the information shared?
Check whether information is shared with service providers, business partners, advertisers, affiliates, or other third parties.
How long is information retained?
Some privacy laws require organizations to explain how long certain information is kept or the criteria used to determine retention.
What choices or rights do you have?
Depending on the applicable law, you may have rights to access, correct, delete, or limit certain uses of your personal information.
The future of privacy
Privacy will continue to evolve as technology, consumer expectations, and regulations change.
For businesses, that means privacy cannot be treated as a document that is written once and forgotten. Organizations need to regularly review what information they collect, why they collect it, how they use it, and whether their privacy practices still match their policies and legal obligations.
For consumers, understanding privacy policies can help you make more informed decisions about the services and technologies you use.
The goal is not to eliminate data collection. Many digital services depend on personal information to function. The goal is to make data collection and use more transparent, purposeful, secure, and respectful of individual privacy.
Frequently Asked Questions
What is the purpose of a privacy policy?
A privacy policy explains how an organization collects, uses, shares, stores, and protects personal information and, where applicable, describes the privacy rights and choices available to individuals.
Does every company have to have a privacy policy?
Not necessarily. Privacy requirements depend on factors such as the organization's location, the people it serves, the type of information it collects, and the laws that apply to its activities. Organizations should determine which privacy requirements apply to them.
Does a privacy policy protect my information?
A privacy policy explains an organization's stated data practices, but it is not itself a security control. Organizations also need appropriate technical, organizational, and administrative safeguards to protect personal information. The FTC advises businesses to review their privacy policies and make sure they honor the privacy promises they make to consumers.
Why do privacy policies seem so complicated?
Privacy policies often need to describe complex data practices and legal requirements. However, privacy regulations increasingly emphasize clear and understandable information. The GDPR, for example, specifically calls for privacy information to be provided in clear and plain language.
How are privacy and cybersecurity different?
Privacy concerns how personal information is collected and used. Cybersecurity concerns protecting systems and information from threats. The two areas overlap because protecting personal information requires appropriate security measures.
Privacy is an ongoing conversation
As technology becomes more connected and data becomes more valuable, privacy concerns will continue to influence how organizations collect and use personal information.
Privacy policies give consumers a way to understand those practices, while privacy laws establish requirements and rights that organizations may need to follow.
The most important question is not simply whether a company has a privacy policy. It is whether the company's actual practices are transparent, responsible, and consistent with the promises it makes about your information.
