Does your website need a Privacy Policy? Spoiler alert: probably

It is a question we hear a lot from small business owners: “Do I actually need a privacy policy?” Usually it comes up halfway through a website build, when someone notices the empty link in the footer and wonders whether it really matters.

The honest answer surprises most people. Plenty of Australian small businesses are not legally required to have a privacy policy at all. Yet almost all of them need one, because the everyday tools on their website, like Google Analytics and the Facebook pixel, make it a condition of use.

In this guide we explain who the law requires to have a privacy policy, why your website tools probably require one anyway, what a good policy should include, and the common mistakes to avoid. We finish with a heads-up about new privacy policy rules that start on 10 December 2026.

The quick version

• The law: the Privacy Act requires a privacy policy from businesses with annual turnover above $3 million, plus some smaller businesses such as health service providers.
• Your tools: Google Analytics and the Meta pixel both require a privacy policy, whatever your size.
• The catch: once you publish a privacy policy, it has to be accurate. Saying something your business does not do can be misleading under the Australian Consumer Law.
• What’s next: from 10 December 2026, covered businesses need to add new information to their privacy policy.

Translator’s note: the law sets the minimum. The tools on your website usually ask for more.

Who must have a privacy policy by law?

Under the Privacy Act 1988, a business required by the Act must have a clearly expressed, up to date privacy policy that is freely available, which in practice means available as a link on your website. This comes from Australian Privacy Principle 1 (APP 1).

This applies if your business has annual turnover above $3 million. Smaller businesses ($3 million or less) are also affected if, for example, they are:

• a health service provider, which includes doctors, pharmacists, allied health, complementary therapists, child care centres and private schools
• a business that trades in personal information, for example buying or selling it without consent
• a contractor delivering services under a Commonwealth contract
• a credit reporting body or a residential tenancy database operator
• a business brought into the anti-money laundering rules, such as real estate agents, lawyers and accountants, for the personal information they handle for those purposes
• related to a larger business that is covered by the Act
• a small business that has chosen to opt in to the Act

Not sure? The OAIC’s small business page has a checklist, and a privacy lawyer can usually confirm it in one conversation.

Why most small businesses need one anyway

Even if the Privacy Act does not apply to you, there is a good chance something else on your website requires a privacy policy.

1. Your website tools require it

If your website uses Google Analytics, its terms of service say you must post a privacy policy that explains your use of cookies and discloses that you use Google Analytics. Meta’s terms for its pixel (the code that tracks Facebook and Instagram ad results) require a clear and prominent notice on every page where the pixel runs. Many booking, email marketing and advertising platforms have similar conditions.

If you use these tools without a privacy policy, you are breaching the terms you agreed to, and the platform can restrict or close your account.

2. Overseas laws can reach you

If you actively sell to, or track the behaviour of, people in the EU or UK, their privacy laws (the GDPR) can apply to you regardless of the Australian small business exemption. Tourism, accommodation and online retail businesses are the most likely to be affected.

3. What you say must be true

The Australian Consumer Law applies to every business, whatever its size. If your privacy policy says one thing and your business does another, that can be misleading conduct. The ACCC has taken large companies to court over misleading statements about how they collect and use personal data, and won.

4. Customers look for it

A clear, honest privacy policy is a trust signal. People are far more likely to fill in a form or make a booking when they can see what happens to their details.

What should a privacy policy include?

For covered businesses, APP 1 sets out what a privacy policy must cover. Even if you are not covered, it is the best structure to follow. In plain English:

1. What you collect. The kinds of personal information you collect and hold, such as names, emails, phone numbers and payment details.
2. How you collect and store it. Forms, bookings, cookies, analytics, emails, and where it is kept.
3. Why you collect it. To answer enquiries, take bookings, send newsletters, improve your website, and so on.
4. How people can see or correct their information. Who to contact and how.
5. How people can complain. And how you will handle a complaint.
6. Whether information goes overseas. And to which countries, where practical. Many website tools store data overseas, so this one catches people out.

Common privacy policy mistakes we see

• A copied template. It mentions things the business does not do and misses things it does.
• The wrong country. American templates that reference US laws and no Australian ones.
• Out of date. Written when the website launched, before the booking system, chatbot, newsletter or ad tracking was added.
• Hard to find. It should be linked from your footer on every page, and near any form that collects personal details.
• No contact details. People need to know who to ask about their information.

A five minute check you can do today

1. Scroll to the footer of your website. Is there a “Privacy Policy” link, and does it work?
2. Read it. Does it describe your business, or could it belong to anyone?
3. List the tools your website uses: analytics, ad pixels, forms, bookings, payments, newsletters, chat. Does the policy mention them?
4. Check the date. If it is more than a year old, or older than your newest tool, it needs a review.
5. Check the contact details. Do they reach a real person at your business?

Coming 10 December 2026: new privacy policy rules

From 10 December 2026, businesses covered by the Privacy Act must also explain in their privacy policy when computer programs make, or play a key part in making, decisions that significantly affect people. That can include chatbots, automated pricing, application systems and even spreadsheets.

Keep an eye on this space. We are publishing a full plain English guide to the new rules in the coming weeks, including what counts, who it applies to and an eight week plan to get ready.

Common questions

Does a small business in Australia legally need a privacy policy?

Only if it is covered by the Privacy Act. Most businesses with turnover of $3 million or less are exempt, unless they are a health service provider or fall into another covered group. In practice, most still need one because their website tools require it.

My website only has a contact form. Do I need a privacy policy?

If you are not covered by the Privacy Act and your website uses no analytics, ad tracking or other third-party tools, you may not be legally required to have one. Most websites do use these tools, though, so check before you decide. A short, honest privacy policy is good practice either way.

Can I use a privacy policy template?

A template is a reasonable starting point, but it must be edited to match what your business actually does. A policy that describes practices you do not follow can do more harm than good.

Where should my privacy policy go?

On its own page, linked from your website footer on every page, and near any form that collects personal details.