Free Terms & Privacy generator
Website Privacy Policy (Multi-State)
A privacy policy written for the 2026 patchwork of CCPA/CPRA and the ~20 states with comprehensive privacy laws.
What is a Website Privacy Policy?
A Website Privacy Policy (Multi-State) is a privacy policy written for the 2026 patchwork of CCPA/CPRA and the ~20 states with comprehensive privacy laws.
Any website or app that collects personal information, since a policy is required the moment you have visitors from California and most other states.
Website Privacy Policy template, current for 2026
Covers the ~20-state comprehensive-privacy patchwork as of 2026 rather than California alone, and adds a global-privacy-control (GPC) honoring clause and an AI/automated-decision disclosure.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Website Privacy Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- What is the legal name of the business publishing this policy? This is the entity that acts as the 'business'/'controller' and is legally accountable for the data practices described.
- What brand, trade name, or 'doing business as' name do you use publicly? Consumers often know you by a brand rather than the legal entity; we name both so the policy reads naturally and stays enforceable.
- What type of entity is the business? Entity type affects how we describe the controller and, in some places, the governing-law framing.
- In what U.S. state is the business formed or headquartered? Sets the default governing-law and contact jurisdiction for the policy.
- What is the primary website or app URL this policy governs? Defines the 'Services' the policy covers so its scope is unambiguous.
- Does this policy also cover mobile apps or other digital properties in addition to the website? If yes, we broaden the definition of 'Services' to reach every covered property.
- What is the effective date of this policy? State laws require a clearly dated policy and a last-updated marker; this is the date it takes effect.
- What email address should consumers use for privacy questions and rights requests? Every state with a comprehensive privacy law requires at least one designated method to submit requests.
- What toll-free phone number or additional request method do you offer (if any)? CCPA generally expects two request methods for businesses that interact with consumers primarily online; a phone or webform satisfies the second.
- What postal mailing address should appear for privacy correspondence? A physical address supports verification and gives regulators and consumers a formal contact point.
- If you offer an online rights-request form, what is its URL? A webform is the most common second request method and satisfies accessibility expectations.
- Which categories of personal information do you collect? CCPA and most state laws require you to disclose the categories you collect; check all that apply.
- If you collect sensitive personal information, which categories apply? CPRA and most state laws treat these specially, often requiring a right to limit use or opt-in consent.
- From what sources do you collect personal information? State laws require disclosing the categories of sources; this maps how data reaches you.
- For what business or commercial purposes do you use personal information? Every comprehensive state privacy law requires you to disclose the purposes of processing.
- To which categories of third parties do you disclose personal information? State laws require disclosing recipient categories so consumers understand where data flows.
- Do you 'sell' personal information as that term is defined under state law? 'Sale' is defined broadly (any exchange for value, including non-monetary consideration) and triggers an opt-out right and a 'Do Not Sell' link.
- Do you 'share' personal information for cross-context behavioral (targeted) advertising? CPRA's separate 'share' concept covers targeted-ad data flows even when no money changes hands; it triggers an opt-out.
- Do you profile consumers in a way that produces legal or similarly significant effects (e.g., automated decisions)? Several 2026 state laws grant an opt-out from profiling for significant automated decisions; we disclose it only if relevant.
- Do you use AI or automated decision-making technology (ADMT) that produces legal or similarly significant effects, or that profiles individuals? California's 2026 ADMT regulations and the Colorado AI Act require disclosing the use of automated decision-making or high-risk AI, the categories of decisions it informs, meaningful information about the logic, and a right to opt out or request human review.
- For which categories of decisions do you use AI or automated decision-making? Describe the significant decisions the technology informs or makes, such as eligibility, pricing, credit, employment, or content and account actions. This becomes the plain-language disclosure required by the CA ADMT rules and the Colorado AI Act.
- Describe, in plain language, the logic and the intended outcomes or key parameters of the automated decision-making. The 'meaningful information about the logic' requirement covers the main types of inputs used, how they are weighed at a general level, and the intended result. Trade secrets need not be disclosed. The description must still let a consumer understand the basis of the decision.
- Do you have data subjects in the European Economic Area (EEA), the United Kingdom, or Switzerland? If yes, we add a GDPR/UK GDPR block: lawful bases, data-subject rights, EU/UK representative and DPO, and a lawful transfer-mechanism clause (SCCs / UK IDTA / adequacy).
- On which lawful bases do you rely to process personal data of EEA/UK data subjects? GDPR Article 6 requires identifying at least one lawful basis for each processing purpose; check all you rely on.
- Who is your EU representative under GDPR Article 27 (name and contact), if appointed? Controllers or processors without an EEA establishment that offer goods or services to, or monitor, EEA individuals generally must appoint an EU representative. Leave blank if not yet appointed.
- Who is your UK representative under UK GDPR Article 27 (name and contact), if appointed? A separate UK representative is generally required to reach UK individuals if you have no UK establishment. Leave blank if not yet appointed.
- Who is your Data Protection Officer (name and contact), if you have appointed one? Required under GDPR Article 37 for certain processing; where appointed, the contact must be published. Leave blank if not applicable.
- Where you collect consumer health data (Washington My Health My Data Act and similar laws), how will consumers reach you for health-data requests? The Washington My Health My Data Act requires a separate consumer-health-data notice, opt-in consent or a signed authorization for collection and any sharing, and a right to withdraw consent and delete. Provide a contact method (or leave blank to use the general privacy contact).
- Do you honor Nevada residents' requests not to sell covered information under Nevada NRS 603A? Nevada is not a comprehensive-privacy-law state, so its opt-out of sale is separate from the CCPA/state-law 'sale' opt-out. Its 'sale' definition is narrower (licensing for another operator's use); confirm you will honor verified requests.
- Does the site use cookies, pixels, SDKs, or similar tracking technologies? Determines whether we include a tracking-technologies section and honor Global Privacy Control signals.
- Will you honor browser opt-out preference signals such as Global Privacy Control (GPC)? California and most 2026 laws require treating a recognized opt-out signal as a valid opt-out of sale/share.
- How do you determine how long you keep personal information? CPRA and newer laws require disclosing retention periods or the criteria used to set them.
- Are the Services directed to children, or do you knowingly collect data from minors? Drives COPPA (under 13) and state minor-consent language; most B2B/professional sites answer 'no.'
- Do you offer financial incentives (discounts, rewards) in exchange for personal information? California requires disclosing the material terms of any financial incentive or price/service difference tied to data.
- Describe the financial incentive and its material terms. We must state the incentive, the categories of data involved, and how to opt in or withdraw.
- Do you process or store personal information outside the United States? If yes, we add a cross-border transfer notice; if no, we keep the policy US-focused.
- Which state's law should govern the interpretation of this policy? Typically your headquarters state; sets the default governing-law clause without overriding consumers' statutory rights.
Frequently asked
About the Website Privacy Policy and how HDAi works.
What is a Website Privacy Policy (Multi-State)? +
A Website Privacy Policy (Multi-State) is a privacy policy written for the 2026 patchwork of CCPA/CPRA and the ~20 states with comprehensive privacy laws. Any website or app that collects personal information needs one, because the requirement attaches the moment you have visitors from California and most other states.
Is HDAi's Website Privacy Policy (Multi-State) legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it; how far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Website Privacy Policy (Multi-State)? +
You can generate and download the Website Privacy Policy (Multi-State) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Website Privacy Policy (Multi-State) current for 2026? +
Covers the ~20-state comprehensive-privacy patchwork as of 2026 rather than California alone, and adds a global-privacy-control (GPC) honoring clause and an AI/automated-decision disclosure.
How long does the Website Privacy Policy (Multi-State) take? +
Estimated time about 19 min (37 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Website Privacy Policy (Multi-State) work in my state? +
HDAi's interview is state-aware. If you ask an attorney to finish the draft, a licensed Hart David Carson attorney confirms it against your state's requirements before you rely on it. Validity and required formalities vary by state.
Other jurisdictions
The same document, drafted for another jurisdiction’s law.
Terms & Privacy
Related generators
Website Terms of Service · Privacy Policy (Multi-State + GDPR-Lite) · Cookie Policy & Consent Notice · Acceptable Use Policy · All 124 →