Drafting a Privacy Policy

One of the big buzzwords these days is "privacy". You cannot go to the mailbox anymore without opening it up and finding a new "privacy policy" from some company with whom you're affiliated. This privacy policy concept is not limited to the physical world either, not by any means.

These days most web sites have privacy policies. Many online advertisers require the sites on which they place their ads to have active privacy policies. Likewise you'd be hardpressed to find an online store without a privacy policies. Sites aimed at children are also required to have such policies in place to remain in compliance with the Children's Online Privacy and Protection Act. In short, it's good practice for all sites to maintain an active privacy policy.

Drafting a privacy policy needn't be as daunting a task as it sounds. Basically you should ask yourself, "does my site collect personal information about my visitors?". If the answer is no, your privacy policy will be simple to construct. If the answer is yes, then you need to think about what types of data you collect and how. Include this information in your privacy policy.

If you use cookies to collect personal information, for example, you should say in your privacy policy something to the effect of "this site uses cookies to collect information about our users". Then tell what kind of information you collect.

Next think about what you do with the information you collect. Is the information used generally, for research? Do you harvest email addresses for a mailing list? Whatever you do with the information, that information needs to be included in your privacy policy.

How is the information stored? Is it secure? Is it in a database at a top security datacenter? Is it on a firewalled server within your facility? Is it on a floppy disk in your market research technician's desk? At any rate, you need to place this information within your privacy policy as well.

Do you sell, rent, or give personal information you collect to other individuals or companies? This needs to be included as well. Remember that, if you collect information at all, it's good policy to state that you will give information out to law enforcement under court order, even if you would not otherwise give out the information.

Finally, include contact information for those who have questions or concerns related to their privacy to get in touch with you.

If your site is aimed at adults then you're privacy policy is probably complete at this point. Those who run site's aimed in whole or part at children need to include specifics about their compliance with the Children's Online Privacy and Protection Act and will probably wish to consult an attorney to ensure their compliance.

If creating your own privacy policy seems to daunting, you may wish to check out EPIC.org. They offer a privacy policy "Wizard" as a free service. This asks a series of questions about your site and drafts a policy for you based upon your answers.