Does a Small Contractor Website Need a Privacy Policy?

“My site has a contact form. Do I need a privacy policy?” For most contractors the practical answer is yes, and the reasons are smaller and more specific than the giant privacy laws you read about. A California law reaches any commercial site that collects a Californian’s name and number. The analytics tool on your site may require one in its terms. The wireless industry’s texting guidelines call for one. And once you post a policy, federal law expects you to do what it says. Here is each reason, the big laws you are probably too small for, and what a short, honest policy contains.

California’s law reaches past California

The California Online Privacy Protection Act (CalOPPA) says an operator of a commercial website “that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit” the site “shall conspicuously post its privacy policy” (Cal. Bus. & Prof. Code §22575(a)). Two definitions make it a contractor’s problem:

• Personally identifiable information includes a first and last name, a home or other physical address, an email address and a telephone number (§22577(a)). A request form that asks for a name, a phone number, an email and the job address collects all four.
• A consumer is any individual who seeks or acquires goods or services “for personal, family, or household purposes” (§22577(d)). A homeowner asking about a repair is one.

The law turns on where the visitor lives, not where you work. A contractor in Ohio does not choose who fills in the form, and a Californian arranging a repair at a parent’s house in your town is still a California resident. The statute gives a cushion: an operator violates the posting rule only if it fails to post within 30 days after being notified of noncompliance (§22575(a)). But it also makes failing to follow your own posted policy a violation when done knowingly and willfully, or negligently and materially (§22576). California’s Attorney General summed the law up as requiring operators “to say what they do and do what they say.”

The big state privacy laws, and why most contractors fall below them

The laws behind “do not sell my information” links and data-access requests set thresholds that a small trade business rarely meets:

• California’s CCPA applies to a for-profit business that does business in California and meets one of three tests: annual gross revenues over $25,000,000 in the preceding year as adjusted, or buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50% or more of its revenue from selling or sharing personal information (Cal. Civ. Code §1798.140(d)). The California Privacy Protection Agency adjusted the revenue figure to $26,625,000 from January 1, 2025.
• Virginia’s law applies to those that control or process the personal data of at least 100,000 consumers in a calendar year, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data (Va. Code §59.1-576(A)).
• Texas is built differently. Its law applies to a person that is not a small business as defined by the U.S. Small Business Administration (Tex. Bus. & Com. Code §541.002(a)), but even a small business may not sell personal data that is sensitive data without the consumer’s prior consent (§541.107).

So a five-truck company that answers leads and never sells its list is very likely outside these laws’ main duties. That changes if you sell or share customer lists, buy large lists, or grow, and each state words its law its own way, so read yours if any of that describes you. Being outside the big laws does not remove the smaller reasons below.

Two reasons that have nothing to do with state law

Your analytics. If your site uses Google Analytics, its terms say: “You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies, identifiers for mobile devices … or similar technology used to collect data,” and “You must disclose the use of Google Analytics, and how it collects and processes data.” If a web designer set up your site, ask whether it is installed.

Texting. If you text customers, or plan to, the wireless industry’s guidelines say message senders should maintain and conspicuously display a privacy policy that clearly describes how they collect, use and share information, and that it should be referenced in and accessible from the initial call-to-action, such as the consent line on your form (CTIA Messaging Principles and Best Practices, May 2023). The consent rules themselves are in Texting Customers in 2026.

Once you post one, it binds you

The FTC’s business guidance is short: “If your company makes privacy promises – either expressly or by implication – the FTC Act requires you to live up to those claims.” This is why a policy copied from a large company is risky. It may promise things you do not do, or deny things you do, such as sending every lead to a scheduling app, an email service and a subcontractor. A short policy that is true beats a long one that is not.

What a plain policy says

CalOPPA’s list (§22575(b)) and the Attorney General’s recommendations give a contractor’s policy eight short parts:

1. What you collect. The name, phone, email, address, job details and photos people send, plus what your site’s tools collect on their own, such as cookies and analytics data.
2. Who you share it with, by category: the companies that host your website and email, your scheduling and invoicing software, your analytics provider, and the subcontractors who do the work. The Attorney General recommends linking to those third parties’ own privacy policies where you can.
3. What you use it for. Answering the request, scheduling, invoicing. The Attorney General recommends explaining any use beyond what the customer’s request needs, such as marketing emails.
4. Tracking. How your site responds to a browser’s “Do Not Track” signal, and whether other parties may collect information about a visitor’s activity across different websites while they use yours (§22575(b)(5) and (6)). If your site does not respond to the signal, say so plainly.
5. Corrections. If you let customers review and ask to change their information, describe how (§22575(b)(2)), and give an email address for questions.
6. Security. A general description of how you protect the information, without detail that would help an attacker.
7. How long you keep it. Tie this to your real habits; How Long to Keep Business Records covers the periods.
8. Changes and the date. How you will tell people about material changes, and the policy’s effective date (§22575(b)(3) and (4)).

Write it the way you talk. The Attorney General’s first recommendation is to “use plain, straightforward language” and avoid technical or legal jargon. As an example of the tone, here is how part 2 might read for a small painting company:

When you send us a request, your name, phone number, email, address and job details go to us by email through our website host. We enter them in our scheduling software to book your visit. If a subcontractor does part of the work, we give them your name, address and phone number for that job. We do not sell your information.

Every sentence in that example has to be true for the business that posts it; change it to match yours.

Collect less, and the policy gets shorter

The FTC’s guide for businesses starts with “take stock” and “scale down”: know what personal information you have, and keep only what you need. It is blunt about sensitive data: “If you don’t have a legitimate business need for sensitive personally identifying information, don’t keep it. In fact, don’t even collect it.” A request form needs a name, a way to reach the person, the address and the job. It does not need a birth date.

Where to put it

CalOPPA counts a text link as conspicuous when it is on the home page, or the first significant page after entering the site, and includes the word “privacy” (§22577(b)(3)). A “Privacy Policy” link in the footer of every page does that. Add one beside your form’s send button and any texting consent line, so the person sees it where they give you their details. It sits with the other pages a contractor site needs, covered in The Website Pages a Contractor Needs.

If your site uses NapkinPrice™, our price-range tool, it collects the homeowner’s name, number and answers about the job and sends them to you as a lead, so name it in part 2 along with your other services.

General information, not legal or tax advice. Rules change and vary by state; check with the agency named above or a professional for your situation.