Reading Your Own Privacy Policy

The page nobody at the business has read

Today is Data Privacy Day, and most small business websites have a privacy policy that nobody at the business has read since it went up.

It usually came from somewhere else: a template, a generator, or another company's site with the name changed. It was added because a site should have one.

Meanwhile the site has changed. Analytics was added, then an advertising pixel, a booking tool and an embedded map. The policy still describes the site as it was, or a site that never existed.

This morning is a good one to read it properly, against what the site actually does.

Why it has to describe your site

A privacy policy is a statement of fact: what you collect, why, who else receives it, how long you keep it, and who to ask. A wrong statement of fact is worse than a short one.

Canadian privacy law expects businesses to be open about how they handle personal information, and the policy is where people look. The few who read it are the ones who care most.

Two common services go further. Google requires sites using the advertising features in Analytics to say so in their privacy policy, and Facebook's terms for its pixel require a notice too.

What the site actually does

• Analytics, which records visits and sets cookies in each visitor's browser.
• An advertising pixel from Facebook or Google, recording visits for later ads.
• Form submissions, emailed and often stored in the site's database.
• A mailing service, usually based outside Canada, holding the newsletter list.
• Embedded maps and videos, which load from Google and YouTube.
• Booking, chat or payment tools run by other companies.

The second is the one most often missing. Pixels tend to be added for one campaign, by whoever ran it, and nobody tells the person who looks after the policy.

Getting the real list

The owner rarely knows everything the site loads, and should not have to guess.

Whoever maintains the site can list every outside service a page calls on in a few minutes, from the code or from Google Tag Manager if the site uses it.

Ask for it in plain words: what each service is, which company runs it, and what it receives. That list is the outline of the policy.

Analytics, pixels and embeds

Analytics records which pages people visit, roughly where they are and what device they use, with cookies. The policy should say so, and say whether the advertising features are switched on.

A pixel goes further, recording visits so that the same people can be shown ads later. Name the pixels the site uses, say what they are for, and explain how to opt out.

Embedded maps and videos are easy to forget. A YouTube video or a Google map sends information to Google as the page loads, before anybody touches it.

YouTube's privacy-enhanced mode, which whoever maintains the site can switch on, holds back its cookies until the video is actually played.

Forms and the mailing list

The forms are where people hand over information deliberately, and the policy should match what actually happens to it.

Say what each form collects, where it goes, and how long it is kept. If the form plugin stores entries in the database, give the retention period you have set.

The mailing service needs a line of its own. Many are based in the United States, so the policy should say that information may be stored outside Canada.

A worked example

A dog grooming business in a converted storefront had a privacy policy copied, with the name changed, from an American online pet supply shop.

It described orders, shipping, a mobile app, a section on children written for an American law, and a promise never to share information with anyone. The groomer had no shop, no app and no shipping.

What it did have went unmentioned: an online booking service, text reminders sent by another company, a Facebook pixel added for a spring promotion, and a form that collected each dog's vaccination records.

A customer raised it after seeing an ad for the groomer the evening she booked. She asked, reasonably, how Facebook knew.

The new policy is shorter and entirely about the business. It names each outside service and what it receives, says how long vaccination records are kept, and explains how to opt out of the ads.

What templates get wrong

Templates are written for a generic business, often an American one, and their errors fall into a few patterns.

They mention things you do not do, such as apps, shipping or children's accounts. They miss things you do, such as the pixel and the booking tool.

And they make promises, such as never sharing information with anyone, that become false the moment a site adds an outside service. Some even keep another company's name in a paragraph nobody reread.

Keeping it true

A policy is accurate on the day it is checked. It drifts every time somebody adds a plugin, a tag or a new tool.

Make the policy part of the change. Whoever adds a service to the site, staff or an outside company, tells whoever looks after the policy, and it is updated that week.

Put a last updated date at the top, name the person who answers privacy questions, and read the whole thing once a year. Today is a reasonable date to choose.

The counter-case

Some sites have very little to say.

A site with no forms, no analytics and nothing embedded collects almost nothing, and its policy can be a few honest sentences. Length is not the goal; accuracy is.

A business handling health, financial or children's information has more to consider than a website review covers, and its policy deserves a lawyer's reading.

Either way, the policy has to describe your site, not the one the template was written for.

This morning

1. Read the whole policy from top to bottom.
2. Ask for a list of every outside service.
3. Mark each service the policy does not mention.
4. Strike out everything you do not do.
5. Add how long each kind of information is kept.
6. Name the person who answers privacy questions.
7. Date it and book next year's reading.

Step two is the one that makes the rest possible. Without an accurate list of what the site loads, the policy can only be rewritten from one guess to another.

The wording on the forms themselves is covered in consent wording after the first big GDPR fine.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.