Does your NC business website need a privacy policy?

Sometimes the law says yes outright, and in almost every other case the law makes one the sensible thing to have. What we will not tell you is that one statute imposes a general privacy-policy mandate on every North Carolina small business site, because we have not found a primary source that says so. Here is what the sources we did read actually require.

The details

The clearest yes is federal. If any part of your site is directed at children, the FTC's rule is plain (COPPA privacy-policy duty even with no collection): even a child-directed site that collects no personal information at all must still post a privacy policy, and the operator must link its children's-data practices from the home or landing page of the children's area. The FTC summarises the scope as COPPA — under-13 rule, effective April 21, 2000: it reaches only the collection of personal information from children under 13. A summer camp, a kids' surf lesson or a family activity page can fall inside it.

The state layer works differently: it does not demand a policy page, it defines a liability. The state's list (G.S. 75-66 — what counts as personal information) sets out what counts as personal information — a name combined with a Social Security number, a driver's licence or passport number, account and card numbers, a PIN, a digital signature, biometric data, fingerprints or passwords. And under the notice statute (G.S. 75-65 — breach notification without unreasonable delay), a business that owns or licenses that information in computerised form must notify affected residents of a security breach without unreasonable delay.

Put those two together and the policy stops being paperwork. Writing it forces you to list what the site collects, where it goes and who can see it — and that list is exactly what you would need on the worst day of your business's year, when you have to decide whether a breach has happened and who must be told.

The policy must also be true. North Carolina's unfair-and-deceptive-practices statute and the FTC's advertising rules both apply to what a business says to the public, and a privacy policy that promises things the site does not do is a public statement that is false. Copying another company's policy is the most common way small businesses end up in that position.

Every site collects something: contact forms, booking tools, analytics and embedded maps all record visitors. And the Justice Department's position that the ADA applies to websites of public-facing businesses is a reminder that the policy itself should be readable — plain language, real headings, and a link visible from every page rather than buried at the bottom of one.

If children are part of your audience, you need one now. If anyone's card, account or login details pass through your site, you need one and a breach plan behind it. For everyone else, write one honestly — it is the cheapest risk assessment you will ever do.