Free Terms & Privacy generator
Privacy Policy (Multi-State + GDPR-Lite)
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors.
What is a Privacy Policy?
A Privacy Policy (Multi-State + GDPR-Lite) is a single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors.
Everyone with a website, app, or store that collects any personal information, which means names, emails, IP addresses, cookies, and orders. Required disclosures now apply well beyond California.
Privacy Policy template, current for 2026
Written for the 2026 reality of ~20 comprehensive state privacy laws (CCPA/CPRA plus Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and more) instead of a California-only policy. It includes the CPRA categories, sensitive-personal-information handling, and 'sale/share' and Global Privacy Control opt-out honoring, with a distinct sensitive-data and children's-data section. It also carries explicit AI/automated-decision and no-training-without-consent disclosures, a toggle-on GDPR/UK-lite section with legal bases and international-transfer language, and a plain-English rights-request path that pairs with the DSR handler doc.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Privacy Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Which business publishes this privacy policy? This is the controller/business responsible for the personal data. Its legal name and address anchor every disclosure and appear in the notice and contact sections.
- What consumer-facing brand, product, app, or site names does this policy cover? Consumers must know which properties the policy governs. List every domain, app, and brand so the scope section is accurate.
- What is the effective date of this policy? State privacy laws require a clear effective date; several also require the policy to be reviewed and updated at least every 12 months from this date.
- In one or two sentences, what does the business do? A plain-language description of your operations frames why you collect data and helps demonstrate the 'necessary and proportionate' processing regulators expect.
- Whose personal data does the business handle? Some states (e.g., California) extend rights to employees and B2B contacts, and children's data triggers extra rules. Selecting the audiences sets which special sections appear.
- Which categories of personal information do you collect? (Use CCPA statutory categories.) The CCPA/CPRA and most state laws require you to disclose the specific statutory categories collected. Each selection populates the collection table with the matching category.
- If you collect sensitive personal information, which types? CPRA and several states give consumers a right to limit use of 'sensitive' data. Listing the specific types lets us describe your handling and the limit-right accurately.
- From what sources do you obtain personal information? State laws require disclosure of the categories of sources. This drives the 'How we collect' section.
- For what business or commercial purposes do you use personal information? You must disclose each purpose of use. GDPR additionally requires a lawful basis, which we map to these purposes.
- How does the business share personal information with third parties? This is the single most consequential privacy disclosure. Whether you 'sell' or 'share' data (as those terms are defined by CCPA/CPRA) determines which opt-out rights and links you must offer.
- Which categories of personal information are sold or shared? The law requires you to list, by category, exactly what is sold or shared and to whom. Omitting this is a common enforcement target.
- To what categories of third parties do you sell or share it? Disclosing the categories of recipients is mandatory for any sale or share and supports the opt-out section.
- Do you knowingly sell or share the personal information of minors under 16? CCPA requires affirmative opt-in ('right to opt-in') for minors: consent from the minor (13-15) or the parent (under 13). If you never do this, we state that clearly.
- How do you determine how long personal information is retained? CPRA and GDPR both require you to state retention periods or the criteria used to set them. A criteria-based statement is acceptable and more durable than fixed dates.
- Does the site/app use cookies, pixels, SDKs, or similar tracking technologies? Tracking tech disclosure is required, and how you handle 'Do Not Track' / Global Privacy Control opt-out preference signals is now a specific state-law requirement.
- Do you honor opt-out preference signals such as Global Privacy Control (GPC)? California and several other states now REQUIRE businesses that sell/share to treat a GPC browser signal as a valid opt-out. Saying yes is the compliant answer where selling/sharing occurs.
- Do you use automated decision-making or profiling that produces legal/significant effects? Colorado, Connecticut, Texas, Oregon, Montana and the 2026 CCPA automated-decision-making regime give U.S. consumers a right to opt out of profiling used to make decisions with legal or similarly significant effects (e.g., about credit, housing, employment, insurance, or essential services). Selecting 'Yes' adds a dedicated U.S. section and a matching opt-out right wired into your request methods and Global Privacy Control handling.
- Briefly describe the automated decision-making or profiling and the type of decisions it informs. State laws expect a plain-language description of the profiling and the kinds of decisions it produces (for example, eligibility, pricing, or fraud screening) so consumers can decide whether to opt out.
- Do you use consumers' personal information to train or improve AI models? Answering 'No' publishes the strongest statement: that you do not use personal information to train third-party or general-purpose AI models without consent, and that any model improvement uses de-identified or aggregated data. Answer 'Yes' only if you sometimes use personal information for model training with consent or as law permits, and we will adjust the language accordingly.
- Do you offer any financial incentives or price/service differences in exchange for personal information (loyalty programs, discounts for signup, etc.)? CCPA requires a separate notice of financial incentive describing the material terms and how you calculate the value of the data.
- Describe the financial incentive and its material terms. The notice of financial incentive must summarize the program, the categories of data implicated, how to opt in/out, and a good-faith estimate of the value of the data to the business and the method used to calculate it.
- Should this policy extend to EU/UK/EEA visitors (GDPR-lite coverage)? If you knowingly serve or market to individuals in the EU, EEA, or UK, GDPR/UK GDPR applies. Turning this on adds lawful-basis, transfer, and EU-rights sections.
- Do you transfer EU/UK personal data outside the EEA/UK (e.g., to U.S. servers)? Cross-border transfers require a lawful transfer mechanism (Standard Contractual Clauses, UK IDTA, or an adequacy decision). This drives the transfers section.
- If applicable, name your EU and/or UK Article 27 representative (or note 'not appointed'). Controllers without an EU/UK establishment that target those markets generally must designate a local representative. If none is appointed, we flag the gap for counsel to resolve.
- Who is the privacy contact or Data Protection Officer for requests? Every policy needs a named channel for rights requests and complaints; GDPR requires DPO contact details where a DPO is mandated.
- By what methods can consumers submit privacy rights requests? State laws require at least two designated methods for most businesses (a web form and often a toll-free number). This populates the 'how to exercise your rights' section.
- Will you accept requests submitted by an authorized agent on a consumer's behalf? California and other states require you to permit authorized-agent requests and to describe how you verify them.
- Which U.S. state's law governs interpretation of this policy and the company's principal place of business? Sets the governing-law reference and helps identify any state-specific supplemental notices (e.g., Illinois BIPA if biometrics are involved).
- Include any of these state-specific supplemental notices? A few states have notice requirements of their own on top of the common framework. Select any that apply to your operations.
- How will you notify consumers of material changes to this policy? You must describe how updates are communicated. Posting with a revised effective date is standard; email notice is stronger for material changes.
Frequently asked
About the Privacy Policy and how HDAi works.
What is a Privacy Policy (Multi-State + GDPR-Lite)? +
A Privacy Policy (Multi-State + GDPR-Lite) is a single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Anyone with a website, app, or store that collects personal information needs one, since names, emails, IP addresses, cookies, and orders all count, and required disclosures now apply well beyond California.
Is HDAi's Privacy Policy (Multi-State + GDPR-Lite) legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it; how far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Privacy Policy (Multi-State + GDPR-Lite)? +
You can generate and download the Privacy Policy (Multi-State + GDPR-Lite) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Privacy Policy (Multi-State + GDPR-Lite) current for 2026? +
Written for the 2026 reality of ~20 comprehensive state privacy laws (CCPA/CPRA plus Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and more) instead of a California-only policy. It includes the CPRA categories, sensitive-personal-information handling, and 'sale/share' and Global Privacy Control opt-out honoring, with a distinct sensitive-data and children's-data section. It also carries explicit AI/automated-decision and no-training-without-consent disclosures, a toggle-on GDPR/UK-lite section with legal bases and international-transfer language, and a plain-English rights-request path that pairs with the DSR handler doc.
How long does the Privacy Policy (Multi-State + GDPR-Lite) take? +
Estimated time about 15 min (30 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Privacy Policy (Multi-State + GDPR-Lite) work in my state? +
HDAi's interview is state-aware. If you ask an attorney to finish the draft, a licensed Hart David Carson attorney confirms it against your state's requirements before you rely on it. Validity and required formalities vary by state.
Terms & Privacy
Related generators
Website Terms of Service · Cookie Policy & Consent Notice · Website Privacy Policy (Multi-State) · Acceptable Use Policy · All 124 →