Let's talk about something that might not be the most exciting part of running an online business but absolutely should be checked off your to-do list: your website privacy policy.
If you collect any personal information through your website (think email addresses, contact forms, payment info, cookies) then legally, you're required to have a privacy policy. And if you're a Canadian service provider, coach, or freelancer serving clients across borders, the stakes are even higher.
In this post, I'll walk you through:
- What a privacy policy is (and how it differs from your website terms of use)
- What your website privacy policy needs to include, for Canada and beyond
- What laws apply (hello, PIPEDA)
- Whether you still need one if your site is on Shopify, Squarespace, or WordPress
- The legal risks of skipping it, or copying someone else's
Let's dive in.
What Is a Privacy Policy?
A privacy policy is a written statement on your website that explains how you collect, use, store, and protect personal information from visitors.
Personal information includes anything that can identify someone directly or indirectly: names, emails, IP addresses, payment details, you name it.
If you collect data through any of the following, you need one:
- Contact forms
- Digital downloads, freebies, and other resources
- Newsletter signups
- Client onboarding forms
- Analytics tools (like Google Analytics)
- Embedded third-party tools (like payment processors)
It's more than a "nice to have." It's a legal requirement.
Privacy Policy vs. Website Terms of Use: What's the Difference?
People mix these two up all the time, so let's clear it up.
A privacy policy is the document that explains how you collect, use, store, and protect personal information. It's the one required by privacy laws like Canada's PIPEDA, the EU's GDPR, and California's CCPA and CPRA.
Your website terms of use (sometimes called "terms and conditions") are the rulebook for using your site. They cover things like your refund policy, how you license your intellectual property, payment terms, disclaimers, and acceptable use. This is the document you'll lean on to set boundaries and protect your business if a dispute comes up.
Most online businesses need both, which is exactly why our template covers them together.
What Does a Website Privacy Policy Need to Include?
In Canada, your privacy policy needs to be clear, accessible, and cover all the ways you handle personal info. But if your website is open to visitors in the US or EU (which, let's face it, almost all websites are), it also needs to comply with stricter international laws.
A solid privacy policy should include:
- What personal information you collect (name, email, IP address, payment info, etc.)
- How you collect it (directly through forms, or indirectly through cookies and analytics)
- Why you collect it (to deliver services, send newsletters, improve the site, etc.)
- How you use it (only for stated purposes? do you share with third parties like payment processors?)
- How you store and protect it (encrypted servers? password protection?)
- User rights, including how someone can request access to or deletion of their data
- Cookie use and tracking, if you use tools like the Facebook Pixel, Google Analytics, or other tracking software
- Third-party services, like email marketing platforms, booking tools, or payment gateways that may also handle data
- How users can contact you to request changes or raise privacy concerns
What Privacy Laws Apply in Canada (and Beyond)?
The big one in Canada is PIPEDA, the Personal Information Protection and Electronic Documents Act. PIPEDA applies to most businesses across Canada and sets out the rules for how you collect, use, and disclose personal information in the course of commercial activities.
One thing a lot of business owners miss: Canadian privacy law generally requires consent from your website users to collect, use, and disclose their personal data, including data gathered through cookies. Using express, informed consent (think a clear cookie banner and an honest policy) is the safest way to get it. If you're collecting emails for a newsletter, the same idea applies, and you'll also want to be on top of your email marketing legal obligations under CASL.
And if you're using tools like Meta Ads or Google Analytics, marketing to or working with people located in the US or EU, or building an email list that includes them, you also need to be aware of:
- GDPR (the General Data Protection Regulation in the EU)
- CCPA and CPRA (California's privacy laws)
- Other state-specific privacy laws that keep popping up across the US
Translation: even if you're Canadian, your privacy policy needs to cover your legal bases internationally, especially if you're serving clients globally (which most online service providers are).
Do I Still Need a Privacy Policy If My Site Is on Shopify, Squarespace, or WordPress?
Yes. This is one of the most common questions I get, and the answer surprises people.
Platforms like Shopify, Squarespace, and WordPress have their own privacy policies, but those only govern their platform, not your website and the unique way you collect and use data. You still need a privacy policy specific to your business, your tools, and your practices. Relying on the platform's policy leaves you exposed.
Why It's Important to Have a Website Privacy Policy
Here's what a clear, legally sound privacy policy does for you:
- Builds trust with your audience
- Shows you respect and protect your clients' data
- Helps you comply with your legal obligations (and avoid fines or complaints)
- Creates a professional, legitimate presence online
- Reduces your liability if something goes sideways with third-party tools
If you're growing your business, building an email list, or running online ads, your privacy policy isn't just a box to check. It's a must-have. Many third-party platforms (Google Analytics, the Facebook Pixel, Stripe, PayPal) actually require you to have one before you can use them.
Legal Consequences of Not Having a Privacy Policy
Skipping the privacy policy? Here's what's on the line:
- Fines and penalties under PIPEDA, GDPR, and other privacy laws
- Customer complaints and reputational damage if someone feels their data was mishandled
- Being shut out of advertising platforms or third-party tools that require a valid privacy policy
- Breach of contract if you're working with collaborators, affiliates, or clients who expect you to have privacy practices in place
- Frivolous legal claims from people who make a business out of claiming their privacy rights have been violated
Why You Shouldn't Copy Someone Else's Privacy Policy
I get it. It's tempting to just swipe a policy from a competitor's website and tweak a few words. But here's why that's a terrible idea:
- You don't know what they do behind the scenes. Their policy might not match your business.
- It might not comply with Canadian law, or any law at all.
- You're opening yourself up to legal risk and copyright infringement.
- It won't cover your actual tools, services, or use of data, which means it's not protecting you.
Bottom line? A copy-paste job won't cut it. Your privacy policy needs to reflect your business. Even if a competitor seems more established, you never know where they got their policy, or whether it's even legally compliant.
Website Terms of Use and Privacy Policy Templates for Canadian Businesses
If you're a Canadian coach, freelancer, or online service provider, our Website Terms of Use and Privacy Policy Template Bundle is designed with you in mind.
Here's what makes it different:
- Complies with Canadian privacy law (PIPEDA), plus strict US and EU requirements
- Written in plain language, so your clients actually understand it
- Easy to customize, with prompts to make sure it matches your actual practices
- Includes a Privacy Policy Checklist to help you implement it properly
- Created by a Canadian business lawyer (hi, that's me!) who understands your industry and your clients
Whether you're just launching your site or updating your existing legal policies, our template gives you peace of mind knowing you're legally covered and ethically aligned.
Final Thoughts: Protect Your Business the Smart Way
A proper website privacy policy is one of the most important legal tools in your online business toolkit. Trust and compliance matter more than ever, and this is one step you can't afford to skip.
If you're ready to check this off your legal to-do list, grab our Website Terms of Use and Privacy Policy Template Bundle and make sure your business is buttoned-up and privacy-law compliant, across Canada and beyond.
Leave a comment