A Startup Guide to Privacy and Terms of Service

I n the modern age, a website is a must. Every website collects data about who visits it, sometimes including information that may be

identifiable. Consequently, several governments have adopted regulations surrounding how data can be collected and used. Your website needs a privacy policy and clear terms of service that establish SEC compliance and avoid running afoul of any other relevant regulations. Your policy should be easy to locate and direct visitors to the tools they can use to exercise their rights.

What Data Protection Laws Must You Comply With?

There is currently no comprehensive federal data privacy law in the U.S. However, there are several regulations that you need to follow.

COPPA

The Children’s Online Privacy Protection Act (COPPA) limits what information you can collect about children under age 13. Generally, you cannot knowingly collect or use information about anyone under age 13 without parental consent.

CPRA and CalOPPA

Many states have passed comprehensive privacy laws, including exemplars like the California Privacy Rights Act (CPRA)—which modified the earlier California Consumer Privacy Act (CCPA)—and the California Online Privacy Protection Act (CalOPPA). Under the CPRA, consumers have the right to:

Know who is collecting their personal information
Know how their information is being used
Know to whom their information is being disclosed
Control and limit the use of their information
Access, correct, or delete their information

Businesses must:

Inform consumers how to exercise their rights
Inform consumers how the business collects and uses information
Only collect information for specific, explicit, legitimate, disclosed purposes
Only collect information that is necessary and relevant to those purposes
Provide consumers with the means to obtain, delete, correct, or opt out of the sale or sharing of their information
Protect consumer data

Businesses can be penalized for data misuse. Under CalOPPA, every website must provide a privacy policy that states what information the website collects and how you use that information. The policy must specifically:

List categories of information collected
List types of third parties with whom data is shared
Describe how the consumer can access data and request changes
Describe how consumers are notified about policy changes
Identify the policy’s effective date

A link to the policy must appear on the homepage, and the word “privacy” must be used.

GDPR

Additionally, you need to ensure your website complies with the EU’s General Data Protection Regulation (GDPR). Under the GDPR, you can only process data according to seven principles:

Lawfulness, fairness, and transparency
Limited purposes
Data minimization
Accuracy
Limited storage
Integrity and confidentiality
Accountability

With the internet’s global reach, even if you don’t target EU citizens, you must follow the GDPR.

Your website needs a privacy policy and clear terms of service that establish SEC compliance.

What Is a Privacy Policy for a Website?

Your website’s privacy policy should conform with the law and identify:

The cookies you use and how you use them
What visitor information you collect
How you protect collected information
Where you store that information
How long you store the information
What you do with the information
The policy should also outline visitors’ rights to access or remove the information.

What Are Website Terms of Service?

Website terms of use—otherwise called terms of service or terms and conditions—establish the terms visitors agree to by using the website. Your terms of service explain:

Limitations to your liability for the website’s content
Legal protections for your website’s content
User legal rights and remedies
Your exact terms and conditions will vary based on how actively visitors interact with your site.

How to Create a Privacy Policy

You want to be sure you understand your privacy policy, not just rely on some form filler or online generator tool. Be certain you take these steps when creating your privacy policy.

1. Familiarize Yourself with the Law

You don’t need to read every line of every online data privacy law, but you should become familiar with the core laws and their basic requirements. You want to understand what your policy needs to address and why.

2. Determine What Visitor Data You Want or Need to Collect

Websites have to collect some data to function properly. However, much of the information you may want to collect is optional. Determine what data you wish to collect and what you want to use it for. Keep in mind that you can only collect and share data if you have a legitimate reason.

3. Draft a Policy

Next, you need to draft your policy. You may want to hire a lawyer to complete this step.

4. Review and Revise the Policy

Take the time to review and, as necessary, revise the policy, ensuring it says what you intend. If you haven’t yet consulted an attorney, have one review the policy and provide feedback.

5. Update the Policy As Needed

As you implement the policy, see what works well and what doesn’t, then make changes. Also, keep an eye on significant developments in national and international data protection laws.

How to Create Terms of Service

Your terms of service may be more varied based on what your business does. Some general steps are listed below. Hiring or at least consulting an attorney will help ensure you complete this process properly.

1. Determine What Limitations You Want to Set on Liability

Based on how visitors will use your site and what it will include, determine how you need to limit your liability. For example, if you regularly publish articles, you may establish limited liability for factual errors.

2. Identify Website Content You Want to Protect

Identify intellectual property on your website. Clearly state what your intellectual property includes and how it is protected.

3. Select Your Law

Many terms and conditions select which laws will apply to future disputes and how disputes must be resolved. Decide which state’s laws you want to rely on and whether to require issues to go through arbitration.

4. Decide How You Will Limit Visitor Activity

Depending on what your visitors can do on your site, they may have little interaction with other users or other users’ information. If they do, set terms on what users can and cannot do and what happens if they violate the rules.

5. Draft Your Terms of Use

Once you know the basics, draft your terms. Consider having your lawyer create the draft.

6. Review and Revise the Terms

Again, review and revise your terms as needed. Have your attorney review the terms to ensure that the policy is accurate, efficient, and clear.

7. Update the Terms As Needed

Monitor how your terms work in practice and make modifications. Although the law doesn’t currently require the same structure for terms and conditions, monitor developments that might.

Start Off on the Right Privacy Foot

Websites are a powerful way to get information out there about your business. Creating an effective privacy policy and terms of use is necessary for running a website in our globalized world. Ensure your policy and terms of use are guided by the law, and don’t forget to revisit them if and when things change.

Disclaimer: Bizee and its affiliates do not provide tax, legal, or accounting advice. This material has been prepared for informational purposes only, and is not intended to provide, and should not be relied on for, tax, legal, or accounting advice. You should consult your own tax, legal, and accounting advisors before engaging in any transaction.