Data privacy law for small businesses is genuinely confusing right now, because unlike the EU’s single GDPR framework, the US has a patchwork of state-level laws with different thresholds and requirements. I’m not a lawyer and this isn’t legal advice — but as someone who builds the sites that have to comply with these rules, here’s the practical landscape I walk clients through.
There’s no single comprehensive federal law
Instead, several states have passed their own laws — California’s CCPA/CPRA is the most well-known and often the de facto standard businesses build toward, since it was first and other states have followed similar patterns. Virginia, Colorado, Connecticut, Utah, and a growing list of other states have their own versions, each with slightly different thresholds. If you have customers across multiple states, which most online businesses do, you’re potentially subject to several of these simultaneously.
Have an actual, accurate privacy policy
Not a generic template that describes data practices your site doesn’t follow. I’ve reviewed client privacy policies that mentioned data practices that had nothing to do with what the site actually did, because it was copied from a template. That’s arguably worse than having no policy, because it’s a factually false public statement about your practices.
What your privacy policy should actually describe
What data you collect, why you collect it, whether you share it with third parties (most sites use analytics or ad networks, which counts as sharing), and how users can request their data be deleted or accessed if your applicable state law requires that mechanism. This needs to match your actual tech stack.
Cookie consent, without over-engineering it
If you’re only using essential cookies and basic analytics, a simple, clear cookie notice explaining what you use and linking to your privacy policy is usually sufficient for most US visitors under most current state laws. But if you’re running ad networks or extensive third-party tracking, which is relevant if you’re pursuing AdSense, that increases what you should be disclosing, because ad networks do collect and use data for personalization.
Contact forms deserve specific attention
Don’t collect more data than you need, store submitted data securely rather than emailing it in plain text indefinitely with no retention policy, and if you’re using a third-party form service, know where that data actually lives and whether that vendor is itself compliant.
When to get real legal review
If you serve any customers who are minors, or if your business is in a regulated space like health information or financial data, the requirements get substantially stricter and genuinely warrant a conversation with an actual attorney, not just a developer’s general guidance.
The bottom line
An accurate, plain-language privacy policy that matches your real practices, a reasonable cookie notice if you’re not doing heavy tracking, and secure handling of any personal data you collect covers the practical baseline for most small business websites. It won’t make you bulletproof against every possible legal risk, but it addresses the actual, common exposure — and it’s also just good practice for maintaining customer trust.