The Website Policies Every Business Site Needs in 2026. A Checklist

A business website in the United States needs more than a privacy policy, but it does not need the fourteen-page legal page most template sites ship with. This checklist covers the policies a growing company actually needs, what each has to say, where it goes, and the two or three that most sites get wrong.

We check these as part of the governance section of every Digital Presence & Technology Review, and the pattern is consistent: a privacy policy copied from a generator in 2021, no accessibility statement, no mention of the analytics or chat tools that are visibly running on the page, and nothing about AI. None of that is hard to fix.

The short version

What follows is what each one has to contain to be worth having.

1. Privacy policy

This is the one with teeth. California's Online Privacy Protection Act (CalOPPA) has required a conspicuously posted privacy policy on any commercial site that collects personal information from California residents since 2004, and it does not care where your business is. Since almost every site collects an email address through a form or an IP address through analytics, the practical rule is: every business site needs one.

A privacy policy that holds up says, in plain language:

• What you collect, listed. Names and email from forms; IP, device, and page data from analytics; cookies and identifiers from any pixel; chat transcripts if you run a chatbot; payment details if you take money (and who actually handles them).
• How you collect it. Forms, analytics, cookies, third-party embeds, and anything you buy from a data provider.
• Why, by purpose: replying to you, sending a newsletter you asked for, measuring the site, advertising.
• Who you share it with, by name or category. Your CRM, your email platform, your analytics, your ad platforms, your payment processor, your hosting. This is the section generators get wrong, because they cannot see your tag manager.
• The rights people have, and how to use them. Access, deletion, correction, and opt-out of sale or targeted advertising under the state laws that give them. A working email address or form for requests.
• Children. A statement that the site is not directed at children under 13 (COPPA), unless it is.
• Retention, even roughly. "We keep form submissions for as long as we are in contact with you, and analytics data for 14 months."
• Changes and contact. How you announce changes, and who to write to. A last-updated date at the top.

The state privacy laws (California's CCPA/CPRA, and the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and newer statutes) mostly apply above revenue or data-volume thresholds that a $5M to $30M company may or may not cross. Massachusetts, as of this writing, has a data security regulation (201 CMR 17.00) that requires a written information security program if you hold residents' personal information, but no comprehensive consumer privacy statute yet. The safe design is to write the policy as if the state laws apply, because the rights they grant are cheap to honor and the policy then does not need rewriting when a new state joins.

2. Terms of service

Terms are a contract between you and the visitor. For a brochure site with a contact form, they are a light document: who owns the content, what visitors may not do, that information on the site is not professional advice, limitation of liability, governing law (Massachusetts, for most of our clients), and how disputes get resolved.

They become important the moment the site does anything transactional: user accounts, purchases, downloads with a license, a client portal, reviews or comments, or a free tool whose output someone might rely on. Then the terms need to cover the account rules, payment and refund terms, what the user is licensing to you (their content) and from you (yours), and acceptable use.

Two details that matter: the terms must be presented in a way a court will accept as agreed to (a checkbox or a clear "by continuing you agree" at the point of the transaction, not only a footer link), and the limitation-of-liability and disclaimer language should be written for your business, not pasted from a software company's.

3. Cookie and tracking notice

US businesses are often told they need a European cookie banner. Most do not, and the ones that have one usually have it misconfigured so that it blocks nothing and annoys everyone.

What you do need:

• A cookie and tracking section in the privacy policy that names the categories (necessary, analytics, advertising, functional) and the tools behind them: Google Analytics, Google Tag Manager, Meta or LinkedIn pixels, HubSpot, PostHog or Clarity, a chat widget.
• A way to opt out of targeted advertising and the sale or sharing of personal data if you run ad pixels and serve residents of the opt-out states. A "Your Privacy Choices" link in the footer that honors Global Privacy Control signals is the standard way, and it satisfies California's requirement that opt-out links be conspicuous.
• A consent banner only if you have meaningful EU, UK, or Swiss traffic, in which case non-essential cookies must not load until the visitor consents, which is a technical setup, not a plugin.

The misconfigured banner is a real finding: a site that shows an "accept cookies" banner while every tracker has already fired on page load is making a disclosure it then contradicts. Either wire it properly or take it down and disclose in the policy.

4. Accessibility statement

Title III of the Americans with Disabilities Act is being applied to websites by courts and the Department of Justice, and web accessibility suits against small and midsize businesses have run in the thousands per year for most of the last decade. An accessibility statement does not make a site accessible, but it does three things: it documents the standard you are working to (WCAG 2.1 or 2.2, level AA), it tells people with a problem how to reach you and get the same information another way, and it shows a court or a demand letter that you have a program, not an oversight.

A good one is short: the standard you target, what you have done (an audit date, the fixes made), known limitations if any, how to request help or report a barrier, and when you last reviewed it. Pair it with a real audit. The free website audit above does not test accessibility; the full Review runs the automated checks and flags the common failures (contrast, missing labels, keyboard traps, images without alt text).

Do not install an "accessibility overlay" widget and call it done. Several of the suits in the last three years were filed against sites with overlays installed, on the grounds that the overlay itself broke screen-reader navigation.

5. AI disclosure

This is the new entry on the list, and the one almost nobody has yet.

If your site runs a chatbot, visitors should be told they are talking to an automated system, next to the chat window, and the privacy policy should say what happens to the transcript. If you publish content generated substantially by AI, the policy that governs your own staff should say when you disclose it (our AI policy template builds that clause). If you use AI in any decision about a person who visits the site, such as lead scoring that determines who gets a reply, or screening in an application flow, several state laws now treat that as automated decision-making with notice and opt-out rights, and the policy needs a sentence about it.

Utah and Colorado have statutes in force that require disclosure when a consumer is interacting with generative AI in certain contexts; California's rules on automated decision-making technology are rolling in under the CPRA. The simplest defensible position is to disclose any customer-facing AI, everywhere, now.

6. Email and anti-spam policy

If the site collects addresses for a newsletter or follow-up, CAN-SPAM applies to every message you send. The policy, or the email section of the privacy policy, should say what you send, how often, that every message has a working unsubscribe, that you honor it within ten business days (the law's limit; same-day is the norm), and that you do not sell or rent the list. Say the same thing next to the sign-up box, in one line.

If you send bulk mail (Google and Yahoo's threshold is 5,000 messages a day to their users), your domain also needs SPF, DKIM, and an enforced DMARC policy, or the mail does not arrive. That is not a website policy but it fails together with one; the domain health checker reads the records.

7. Affiliate and sponsorship disclosure

The FTC's Endorsement Guides require clear and conspicuous disclosure whenever you could be paid for a recommendation: affiliate links, sponsored posts, free products reviewed. "Clear and conspicuous" means on the page where the link is, before the reader reaches it, in plain words, not only on a separate disclosure page. A dedicated affiliate disclosure page is still worth having, linked from the footer, so the full explanation lives somewhere; ours is at /affiliate-disclosure/ and every article with an affiliate link carries the short version too.

8. Refund, shipping, and cancellation terms

Any site that takes payment needs the commercial terms stated before purchase: price and what it includes, how and when you deliver, refund and cancellation conditions, and for subscriptions, how to cancel. The FTC's rule on negative options and several state auto-renewal laws (California's is the strictest) require that cancelling be as easy as signing up and that renewal terms be disclosed before the first charge. A services firm that bills retainers should treat its engagement agreement as these terms, and link a summary from the site.

9. Industry notices

Regulated businesses have policies the general list does not cover, and they usually have to be separate documents:

• Healthcare. A HIPAA Notice of Privacy Practices, posted on the site if you have one and given to patients. Any web form that collects health information needs to go to a HIPAA-eligible destination under a business associate agreement, which rules out most free form tools. Analytics and pixels on patient-facing pages have been the subject of enforcement since 2022.
• Financial services and insurance. A GLBA privacy notice, and the annual notice requirement. State insurance regulators add their own.
• Education. FERPA for student records; COPPA if the site is directed at children under 13; state student-privacy laws for vendors to schools.
• Government. Public-records notices, accessibility requirements under Section 508 and state equivalents, and in Massachusetts, the state's web accessibility standard for public bodies.

10. Copyright notice and DMCA

A copyright line in the footer costs nothing and claims your content. If visitors can post anything (reviews, comments, uploads), a DMCA designated-agent registration with the Copyright Office and a takedown procedure on the site are what protect you from liability for what they post. Brochure sites can skip the second half.

Where the policies go, and how to keep them alive

Four rules that cover most of the findings we write:

1. One page per policy, each with its own URL, a clear heading, and a last-updated date at the top. A combined "Legal" page is harder to read, harder to link to from a form, and harder for a search engine or an AI assistant to identify.
2. Footer links on every page, with the privacy policy and terms as plain text links, and "Your Privacy Choices" if you run ad tracking. The accessibility statement goes there too.
3. Link the privacy policy beside every form, in one line: "We use this to reply to you and for nothing else. Privacy policy." People read that line more than they read the policy.
4. Review when the site changes and once a year regardless. Adding a chatbot, a pixel, a new form tool, or a payment processor changes what the privacy policy has to say. New state laws arrive every January.

What this looks like done

The policy pages on this site are the ones in the checklist, each at its own URL: privacy policy, terms, accessibility, cookie policy, email and anti-spam policy, and affiliate disclosure. They are linked from every footer and beside every form, and they name the tools that are actually running on the page. We are not lawyers, and this article is not legal advice; it is the checklist we use when we review a site, and the one we build to when we build one.