A website privacy policy is a published statement of what information your site collects, why it collects it, and who else gets to see it. For almost any commercial website with a contact form, it is effectively required. A cookie banner — the thing small-business owners actually worry about — usually is not.
The confusion is understandable. Install almost any privacy plugin and it opens with a red warning and a pricing page, with a real obligation buried somewhere under the upsell. Here is the honest version: the policy matters, the banner mostly does not, and the thing you are probably not thinking about is a browser signal your site is quietly ignoring.
What a website privacy policy has to say
California’s Online Privacy Protection Act is the reason nearly every American business website has a privacy policy. It has no revenue threshold and no visitor minimum. If your commercial site collects personal information from a California resident — a name and email in a contact form counts — you are expected to post a policy and then actually follow it.
That is a lower bar than most plugin warnings imply, and a real one. A usable policy covers six things:
- What you collect. Form submissions, analytics, anything a store or booking tool captures.
- Why. Answering inquiries, fulfilling orders, measuring traffic.
- Who else sees it. Name the services by name — your analytics provider, your email platform, your payment processor.
- How long you keep it. An honest range beats a precise fiction.
- How someone asks you to delete it. A working email address is enough for a business your size.
- When the policy last changed. A date at the top.
The failure mode is not an incomplete policy. It is a generated policy describing a business you are not running — one that mentions cookie categories you do not use and a data protection officer you have not hired. “Say what you do and do what you say” is the standard, and a policy that misdescribes you fails it in both directions.
Do you need a cookie banner?
For most small businesses serving customers in the United States, no. There is no American law requiring a consent pop-up before a cookie is set. Cookie banners come from the European Union’s ePrivacy rules and the GDPR, which require consent before non-essential tracking begins.
The GDPR reaches American businesses only when they target people in the EU — offering goods or services to them, or monitoring their behavior. The European Data Protection Board’s own guidance on territorial scope is explicit that a website merely being reachable from Europe is not enough to count as targeting. A studio in Santa Fe booking local clients is not targeting Berlin. A shop that lists prices in euros and ships to Germany is.
Twenty states now have comprehensive consumer privacy laws in effect. A few require a visible opt-out link for businesses in scope, but almost none demand a banner, and most small businesses are not in scope at all. California’s thresholds are the usual benchmark: roughly $26.6 million in annual revenue, or data on 100,000 or more California consumers and households, or more than half your revenue from selling or sharing personal information. Clear none of those and the CCPA does not apply to you. The privacy policy obligation still does, because it comes from a different law with no threshold.
Short answer: skip the banner, write a truthful policy, and spend the saved effort on the next two sections.
Most of the cookies on your site are not yours
WordPress itself is close to silent for an anonymous visitor. It sets a short-lived test cookie, and it stores a commenter’s name and email only if they leave a comment — and since WordPress 4.9.6, only if they check a box agreeing to it. That is the whole footprint of the software.
Everything else you find came from something you added. Google Analytics 4 writes a _ga identifier that persists for two years by default. A standard YouTube embed contacts Google’s servers before anyone presses play. An advertising pixel starts building a profile on page load. Even typography can do it: in January 2022 a Munich court ordered a website operator to pay a visitor €100 in damages for loading Google Fonts from Google’s servers, because doing so handed over the visitor’s IP address with no consent and no need — the same fonts can be hosted on your own server for free.
This is why the privacy question belongs in the build, not in a plugin added afterward. When I designed and built the site for Massage of Santa Fe, a Thai massage spa here in town, part of the planning was how a third-party booking tool would eventually sit inside the site. The obligation travels with the tool, not with the website — so you want to know which tools you have signed up for before you write a word of policy.
Inventory it yourself. Open your site in a private window, press F12, and look under Application, then Cookies, in the browser’s developer tools. Every name listed is something your site is doing to a stranger. Three or four is normal. Thirty means a plugin is doing more than you asked.
The opt-out signal your site is probably ignoring
Global Privacy Control is a one-bit message a browser sends with every request, saying the visitor does not want their personal information sold or shared. It costs the visitor one setting, and it is now binding in a growing number of states — California recognized it in 2021, Colorado accepted it as the first approved universal opt-out mechanism, and Connecticut’s law brought it in at the start of 2025.
Enforcement has followed the signal rather than the paperwork. California’s first CCPA settlement, with Sephora in August 2022, cost $1.2 million and turned substantially on a failure to honor GPC requests. In September 2025 California, Colorado, and Connecticut ran a joint sweep looking for businesses ignoring it.
Under the thresholds above, this is not your legal problem. It is still worth knowing, because the day you cross one, the obligation is technical rather than editorial. A policy can be rewritten in an afternoon. Wiring a site to recognize a browser signal and change its behavior is a development task, and far cheaper to plan for than to retrofit.
Where New Mexico stands
New Mexico is not one of the twenty states with a comprehensive consumer privacy law in effect. Bills have been filed — House Bill 214 in the 2026 regular session would have enacted a Consumer Information and Data Protection Act — and as of October 2026, Attorney General Raúl Torrez and Representative Linda Serrato of Santa Fe have said they intend to bring consumer data legislation in the next session.
So your current obligations come almost entirely from other states’ laws reaching your website, and the ground is likely to shift. Neither fact argues for buying a compliance subscription today. Both argue for knowing exactly what your site collects, so that when a New Mexico law does pass, answering it is a reading exercise instead of an audit.
What to do this week
- Inventory your cookies with the developer tools, as above, and write the list down.
- List every third-party service that touches visitor data — analytics, forms, email, payments, booking, chat.
- Rewrite your privacy policy to describe that list and nothing else. Date it.
- Self-host your fonts and switch video embeds to their privacy-preserving option. Both are free and remove a category of exposure.
- Delete any tracking tool you are not actually reading. Most sites carry at least one.
That is a morning’s work, and it leaves you with something a generated policy never does: an accurate description of your own website. None of this is legal advice — if you handle health, financial, or children’s data, talk to a lawyer, because those rules genuinely are different.
Patrick Iverson is a brand strategist and web developer in Santa Fe, New Mexico, who has run an independent practice here since 2001 and built on WordPress since 2003. If you are planning a new site and want the data questions settled during the build rather than patched afterward, that is part of how I approach custom WordPress development. Send me the list you made in step one and I will tell you what stands out.
