Website legal pages in the US

Most US business websites need a privacy policy, and many also need terms of use, a cookie or tracking notice, an accessibility statement and, depending on what you do, SMS terms, a refund policy or industry disclaimers. Which website legal pages apply to you depends on what data the site collects, where your customers live, whether you sell online and what industry you are in.

A quick disclaimer of my own: I build websites, I am not a lawyer, and this article is not legal advice. It is a map of the pages that commonly come up, so you can have a shorter and cheaper conversation with your attorney. Rules change, and state laws keep multiplying, so have a professional review what applies to your business.

Why there is no single checklist

The US has no single federal privacy law for websites. Instead, there is a patchwork: federal rules for specific areas (children's data, health data, email, texting), state privacy laws that apply above certain thresholds, and consumer protection rules enforced by the FTC and state attorneys general. A plumber in Ohio with a contact form and a cosmetic clinic in California running ads with tracking pixels face very different requirements.

The pages, one by one

Privacy policy

Who needs it: nearly every business website that collects any personal information, including names and emails from a contact form, plus analytics and ad tracking data.

California's online privacy law expects commercial websites that collect personal information from California residents to post a privacy policy, and since your site can be visited from anywhere, most businesses treat a privacy policy as a baseline. Ad platforms and SMS providers also require one.

What it usually covers: what you collect, why, how you use it, who you share it with (analytics, ad platforms, CRM, email tools), how long you keep it, how people can contact you, and the rights residents of certain states have.

The common mistake: a copied template that does not match reality. If your policy says you do not share data but your site runs the Meta pixel and Google Ads tags, the policy is inaccurate. Inaccurate privacy statements are what regulators tend to look at.

State privacy rights and "Do Not Sell or Share"

California (under the CCPA as amended by the CPRA) and a growing list of states, including Virginia, Colorado, Connecticut, Texas, Oregon and others, have consumer privacy laws. Each applies above its own thresholds, typically tied to revenue, the number of residents whose data you process or how much of your revenue comes from selling data. Many small businesses fall under none of them. If you do fall under one, you may need specific disclosures, a way to handle requests and, where you "sell" or "share" data for targeted ads, a "Do Not Sell or Share My Personal Information" link and respect for browser privacy signals. My article on state privacy laws and websites goes deeper.

Cookie or tracking notice

The US does not have a general cookie consent law like Europe's, but state privacy laws and ad platform policies affect how you handle tracking. Many businesses use a simple notice with a link to the privacy policy; others need an opt-out mechanism. I cover the options in cookie banners in the US.

Terms of use

Terms set the rules for using your site: intellectual property, acceptable use, limitation of liability, governing law. They matter more if users can create accounts, post content, buy online or rely on information you publish. For a simple brochure site they are less critical, but many businesses still include them.

Accessibility statement

Not a legal requirement for most private businesses, but a good-faith signal: what standard you aim for (usually WCAG 2.1 AA), what you have done and how users can report a problem. See ADA website accessibility for the background.

SMS and texting terms

If your site collects phone numbers for marketing texts, the TCPA and FCC rules require prior express written consent for marketing texts sent with automated systems, and opt-out keywords like STOP must work. Carriers also require 10DLC registration for business texting, and the registration review usually checks that your opt-in form, privacy policy and SMS terms say the right things, for example that mobile numbers are not shared for third parties' marketing. Details in TCPA and SMS marketing.

Refund, shipping and subscription terms

Online stores usually need clear refund, return and shipping policies. If you sell subscriptions or memberships that renew automatically, several states, including California, have automatic renewal laws about clear disclosure and easy cancellation. Your payment processor may also require these pages.

Industry disclaimers and disclosures

• Healthcare: if your site has patient forms or booking, tracking pixels on those pages can create HIPAA risk. Talk to your compliance advisor; see HIPAA and website tracking.
• Legal, financial and medical information: a "not professional advice" disclaimer is common.
• Reviews and endorsements: the FTC requires disclosure of paid or incentivized reviews and bans fake ones.
• Children: sites directed at children under 13 fall under COPPA, which has strict consent rules.

Quick reference

Templates, generators or an attorney?

Template generators are a reasonable starting point for a simple site and much better than nothing. Their weakness is that they ask general questions and cannot see what your site actually does. An attorney is worth it when you handle health data, sell online at scale, run SMS marketing, work with children's data or meet a state privacy law's thresholds. A sensible middle path: start with a generator, then have an attorney review it against your real setup.

What I do on a website project

When I build a site, I list every tool that collects or receives data (forms, analytics, ad pixels, CRM, chat, booking), so whoever writes your policy describes reality. I put the legal pages in the footer, link them from forms, set up consent and tracking settings to match your policy, and make sure opt-in checkboxes for texts and emails are separate and unchecked by default. I do not write legal advice; I make the website match what your attorney or template says. For tracking setup, see consent mode.