Privacy Policy Explainer - Four Columns Marketing

It does not matter what state your business is based in.

“But I don’t do business in _____ state.”

Doesn’t matter. If your website is accessible in that state, and if you have something as simple as Google Analytics on the site, you’re collecting personal information.

These regulations are nuanced, and it’s important to get this right. There are specific requirements outlined in various laws, and while California has the lead on the most … sophisticated of the set, Texas recently passed legislation that does not exempt small businesses from compliance.

Compliance with what, exactly?

The laws that govern privacy don’t just talk about consent—they talk about the data and how you “handle” it, which is quite a bit more complicated than the thumbs-up/thumbs-down of consent. We’re talking about your Privacy Policy.

Your Privacy Policy is a statement from your business about how you collect data, how you use it, how you keep it and a whole lot more. Don’t worry, there’s an explainer section further down.

Cookiebot acts as your main permission/denial signal from website users, your Privacy Policy tells those users how your business handles their personal information.

Okay, but can’t y’all just write this for us?

It’s really important to be clear on this—we are not lawyers. We have a strong, well-researched understanding of what is broadly required in this space, but (1) we can’t honestly speak to the entirety of how each of you is using the data you collect and (2) there may be specific ways in which your leadership or ownership teams want you to create these privacy policies. The only legal advice we have for you is simple: you should consult with an attorney to be sure you’re complying with the law.

There is a solution to this that can help with 80-90% of the work—if you don’t want to learn the ins and outs of what your Privacy Policy needs to include, jump to the next section now >>>.

Now for the educational part!

What does a privacy policy usually cover?

A lot, to put it bluntly. Much like the syllabus for my marketing class, there’s “always something new they’re making you add.” I’d suggest this won’t change anytime soon, but the best expectation for this space is that this will likely continue to grow more burdensome as the patchwork of state laws grows. Most policies address some version of the following:

What Information You Collect
This is a step that Four Columns can help with (part of), because it is a complete inventory of every data point you collect about your website users. This can include everything from their name to what model of iPhone they used to access the site.
This might seem like a lot—and it is.
Where The Data Comes From
This includes sources like the visitor themself (forms, signups), from third parties (data partners, integrations), and automated website functions (cookies, analytics, server logs). The expectation of specificity in these sources is growing.
Why You Collect Data
A strong, specific list of the ways your company uses this data—to inform market decisions, to contact customers, to fill orders, to prevent fraud, and even for legal purposes of your own.
Do You Sell Your Customers’ Data?
“Of course not.” Yeah, you’d think that. This is one of those “it depends what your definition of is, is” problems where even if money isn’t changing hands, information flowing through a Meta Pixel or back into Google Ads could be considered sharing personal information.
Individual Rights
Laws vary—but individuals may have rights to access, correct, delete or opt out of certain uses of their data, and to be legally protected from discrimination for doing so. Policies typically provide a real way to exercise these rights.
Protected Data (Health, Finance, Location)
There are added concerns if you’re handling this type of data, because both federal and state laws can come into play. It’s worth consulting an attorney that knows the specifics of how you need to handle your data in your industry.
Data From Minors
“How would we know?” This is another one of those “it doesn’t matter” questions. You wouldn’t until you did, but after you do, the penalties for not meeting the legal requirements get a lot worse.
How Long You Keep Data
My personal favorite—”forever”—is not going to cut it anymore.* Honestly, this isn’t a bad move from a data-purity standpoint. Not endlessly preserving data saves you money in the long run, so I can actually give you real advice on this one and say it’s worth setting a limit for financial reasons!
How Privacy Policy Connects to Consent (aka Cookiebot)
There’s a way for us to embed this in your privacy policy automatically through Cookiebot, so—more cost savings unless you’re the attorney doing the work.
Housekeeping
Policies are generally (1) dated and (2) kept current.

We’re pushing forward on this because we believe the legal landscape has moved it from “very difficult to enforce” to “growing concern” based on the number of new court cases popping up across the country. We want to help you stay ahead of this, but your Privacy Policy is firmly in your lawyer’s court to help manage.

Ready to learn how Cookiebot and your Privacy Policy can combine to keep you in compliance? Read on.

A necessary word from our not-lawyers.

This article is provided by Four Columns for general informational purposes only. It is not legal advice, it is not a substitute for legal advice, and reading it does not create an attorney-client relationship — or any other kind of privileged relationship — between you and Four Columns. Four Columns is a marketing firm, not a law firm, and nothing here should be relied upon as a legal opinion about your specific situation.

Privacy and data-protection laws vary by jurisdiction, change frequently, and apply differently to every business depending on facts we’re not in a position to assess for you. Any decisions about your privacy policy, your data practices, or your compliance obligations should be made in consultation with a qualified attorney licensed in your jurisdiction. To the fullest extent permitted by law, Four Columns disclaims any liability for actions taken or not taken based on the contents of this article.

Want to learn more about the legal implications? Here’s a quick rundown of what we found.