A privacy policy is a statement or legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data, while a privacy notice tells clients or data subjects what data is held by an organisation and how that data will be handled.Information Commissioner's Office, Create your own privacy notice, updated on 20 August 2024, accessed on 19 November 2025
Personal information can be anything that can be used to identify an individual, not limited to the person's name, address, date of birth, marital status, contact information, ID issue, and expiry date, financial records, credit information, medical history, where one travels, and intentions to acquire goods and services.McCormick, Michelle. "New Privacy Legislation." Beyond Numbers 427 (2003): 10-. ProQuest. Web. 27 Oct. 2011 In the case of a business, it is often a statement that declares a party's policy on how it collects, stores, and releases personal information it collects. It informs the client what specific information is collected, and whether it is kept confidential, shared with partners, or sold to other firms or enterprises. Privacy policies typically represent a broader, more generalized treatment, as opposed to data use statements, which tend to be more detailed and specific.
The exact contents of a privacy policy will depend upon the applicable law and may need to address requirements across geographical boundaries and legal jurisdictions. Most countries have their own legislation and guidelines of who is covered, what information can be collected, and what it can be used for. In general, data protection laws in Europe cover the private sector as well as the public sector. Their privacy laws apply not only to government operations but also to private enterprises and commercial transactions.
History In 1968, the Council of Europe began to study the effects of technology on human rights, recognizing the new threats posed by computer technology that could link and transmit in ways not widely available before. In 1969 the Organisation for Economic Co-operation and Development (OECD) began to examine the implications of personal information leaving the country. All this led the council to recommend that policy be developed to protect personal data held by both the private and public sectors, leading to Convention 108. In 1981, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) was introduced. One of the first privacy laws ever enacted was the Swedish Data Act in 1973, followed by the West German Data Protection Act in 1977 and the French Law on Informatics, Data Banks and Freedoms in 1978.
In the United States, concern over privacy policy starting around the late 1960s and 1970s led to the passage of the Fair Credit Reporting Act. Although this act was not designed to be a privacy law, the act gave consumers the opportunity to examine their credit files and correct errors. It also placed restrictions on the use of information in credit records. Several congressional study groups in the late 1960s examined the growing ease with which automated personal information could be gathered and matched with other information. One such group was an advisory committee of the United States Department of Health and Human Services, which in 1973 drafted a code of principles called the Fair Information Practices. The work of the advisory committee led to the Privacy Act in 1974. The United States signed the Organisation for Economic Co-operation and Development guidelines in 1980.
In Canada, a Privacy Commissioner of Canada was established under the Canadian Human Rights Act in 1977. In 1982, the appointment of a Privacy Commissioner was part of the new Privacy Act. Canada signed the OECD guidelines in 1984.
Fair information practice
There are significant differences between the EU data protection and US data privacy laws. These standards must be met not only by businesses operating in the EU but also by any organization that transfers personal information collected concerning citizens of the EU. In 2001 the United States Department of Commerce worked to ensure legal compliance for US organizations under an opt-in Safe Harbor Program. The FTC has approved eTRUST to certify streamlined compliance with the US-EU Safe Harbor.
Current enforcement In 1995 the European Union (EU) introduced the Data Protection DirectiveOverview of the Data Protection Directive, EC.europa.eu for its member states. As a result, many organizations doing business within the EU began to draft policies to comply with this Directive. In the same year, the U.S. Federal Trade Commission (FTC) published the Fair Information PrinciplesU.S. Federal Trade Commission Fair Information Practice Principles, FTC.gov which provided a set of non-binding governing principles for the commercial use of personal information. While not mandating policy, these principles provided guidance of the developing concerns of how to draft privacy policies.
The United States does not have a specific federal regulation establishing universal implementation of privacy policies. Congress has, at times, considered comprehensive laws regulating the collection of information online, such as the Consumer Internet Privacy Enhancement ActHR 237 IH, The Consumer Internet Privacy Enhancement Act, as Introduced in House, 107th Congress Loc.gov. and the Online Privacy Protection Act of 2001,HR 89 IH, Online Privacy Protection Act of 2001, as Introduced in House, 107th Congress Loc.gov but none have been enacted. In 2001, the FTC stated an express preference for "more law enforcement, not more laws"Kirby, Carrie "FTC drops the Call for New Internet Privacy Laws," SFGate, October 5, 2001. SFgate.com and promoted continued focus on industry self-regulation.
In many cases, the FTC enforces the terms of privacy policies as promises made to consumers using the authority granted by Section 5 of the FTC Act which prohibits unfair or deceptive marketing practices.Implementation of 15 U.S.C. §§ 41-58, FTC.gov The FTC's powers are statutorily restricted in some cases; for example, airlines are subject to the authority of the Federal Aviation Administration (FAA),Electronic Privacy Information Center, Air Travel Privacy, Epic.org. Also, see FAA Enforcement Database at FAA.gov. and cell phone carriers are subject to the authority of the Federal Communications Commission (FCC).Helmer, Gabriel M. "Cracking Down: FCC Initiates Enforcement Action Against Hundreds of Telecommunications Carriers For Failing to Certify Compliance With Customer Privacy Rules Security, Privacy and the Law, Foley Hoag, LLP, May 2009. Securityprivacyandthelaw.com. Also see FCC Enforcement Center at FCC.gov
In some cases, private parties enforce the terms of privacy policies by filing class action lawsuits, which may result in settlements or judgments. However, such lawsuits are often not an option, due to arbitration clauses in the privacy policies or other terms of service agreements.
Applicable law
United States
While no generally applicable law exists, some federal laws govern privacy policies in specific circumstances, such as: The Children's Online Privacy Protection Act (COPPA)The Children's Online Privacy Protection Act, FTC.gov affects websites that knowingly collect information about or targeted at children under the age of 13.COPPA Safe Harbors discussed, Cybertelecom Federal Internet Law & Policy – an Educational Project. Krohn & Moss Consumer Law Center, Cybertelecom.org Any such websites must post a privacy policy and adhere to enumerated information-sharing restrictionsDiscussion of compliance with the Children's Online Privacy Protection Act, FTC Privacy Initiatives, FTC.gov COPPA includes a "safe harbor" provision to promote Industry self-regulation.Data Privacy, A Safe Harbor Approach To Privacy: TRUSTe Recommendations, Center for Democracy and Technology, CDT.org The Gramm-Leach-Bliley ActGramm-Leach-Bliley Act, Loc.gov requires institutions "significantly engaged""The Financial Privacy Requirements of the Gramm-Leach-Bliley Act", FTC Facts for Business", FTC.gov in financial activities give "clear, conspicuous, and accurate statements" of their information-sharing practices. The Act also restricts use and sharing of financial information.Information Regarding the Gramm-Leach-Bliley Act of 1999, US. Senate Committee on Banking, Housing, and Urban Affairs. Senate.gov The Health Insurance Portability and Accountability Act (HIPAA) privacy rulesUnderstanding HIPAA Privacy, HHS.gov Health information privacy, HHS.gov requires notice in writing of the privacy practices of health care services, and this requirement also applies if the health service is electronic.Notice of HIPAA Privacy Practices. Privacy/ Data Protection Project, Miller School of Medicine Miami University, Miami.edu The California Consumer Privacy Act (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. The California Privacy Rights Act of 2020 (CPRA) expands the privacy and information security obligations of most employers doing business in California.
Some states have implemented more stringent regulations for privacy policies. The California Online Privacy Protection Act of 2003 – Business and Professions Code sections 22575-22579 requires "any commercial websites or online services that collect personal information on California residents through a web site to conspicuously post a privacy policy on the site".Privacy Laws, State of California Department of Justice Office of the Attorney General Both Nebraska and Pennsylvania have laws treating misleading statements in privacy policies published on websites as deceptive or fraudulent business practices.Deceptive Trade Practices, Enotes.com
Canada Canada's federal Privacy Law applicable to the private sector is formally referred to as Personal Information Protection and Electronic Documents Act (PIPEDA). The purpose of the act is to establish rules to govern the collection, use, and disclosure of personal information by commercial organizations. The organization is allowed to collect, disclose and use the amount of information for the purposes that a reasonable person would consider appropriate in the circumstance.
The Act establishes the Privacy Commissioner of Canada as the Ombudsman for addressing any complaints that are filed against organizations. The Commissioner works to resolve problems through voluntary compliance, rather than heavy-handed enforcement. The Commissioner investigates complaints, conducts audits, promotes awareness of and undertakes research about privacy matters.
European Union
The right to privacy is a highly developed area of law in Europe. All the member states of the European Union (EU) are also signatories of the European Convention on Human Rights (ECHR). Article 8 of the ECHR provides a right to respect for one's "private and family life, his home and his correspondence", subject to certain restrictions. The European Court of Human Rights has given this article a very broad interpretation in its jurisprudence.
In 1980, in an effort to create a comprehensive data protection system throughout Europe, the Organization for Economic Co-operation and Development (OECD) issued its "Recommendations of the Council Concerning Guidelines Governing the Protection of Privacy and Trans-Border Flows of Personal Data". The seven principles governing the OECD’s recommendations for protection of personal data were: Notice—data subjects should be given notice when their data is being collected; Purpose—data should only be used for the purpose stated and not for any other purposes; Consent—data should not be disclosed without the data subject's consent;