Privacy policy template for a small online store

By the Chatbait team ·

Short answer: a privacy policy says what personal information you collect (name, email, address, payment details, browsing data), why you collect it, who you share it with (payment processors, shipping carriers, email and ad tools), and how a customer can ask you to delete or stop selling it. Copy the template below, fill in your own tools and contact details, and link to it from your footer and checkout. This isn't legal advice; check the sources linked below for your own situation.

Facts last checked on October 19, 2026, against the sources linked below.

What a privacy policy needs to cover

Every privacy policy, however short, should answer these before a customer has to ask:

  • What personal information you collect, and how (checkout, contact form, newsletter signup, cookies).
  • Why you collect it (processing orders, customer support, marketing, if you ask separately for that).
  • Who you share it with (payment processor, shipping carrier, email tool, analytics and ad platforms).
  • How long you keep it.
  • How a customer can see, correct, or delete their information, or ask you to stop selling or sharing it.
  • How to contact you with a privacy question.

Copy-paste privacy policy template

Fill in the highlighted parts with your own store name, tools and contact details.

Template
Privacy policy [Your store name] ("we", "us") collects personal information to run this store and sell our products. This policy explains what we collect, why, and how to contact us about it. Information we collect - Contact and order details you give us at checkout: name, email, shipping address, billing address, and payment details (processed by our payment provider, not stored by us). - Account details, if you create one: email and order history. - Browsing information: pages you visit, device and browser type, and how you found our site, collected through cookies and analytics tools. - Marketing details, if you sign up: your email, for sending newsletters and offers. How we use it - To process and ship your order, and handle returns or support requests. - To send order updates (always) and marketing emails (only if you signed up, and you can unsubscribe any time). - To understand how shoppers use our site, so we can improve it. Who we share it with - Our payment processor ([Shopify Payments / Stripe / PayPal]), to charge your order. - Our shipping carrier ([carrier name]), to deliver your order. - Our email and analytics tools ([tool names]), to send emails and measure site traffic. We don't sell your personal information to third parties for money. Cookies and analytics We use cookies to keep items in your cart, remember your preferences, and measure site traffic through tools like [Google Analytics]. You can block cookies in your browser settings, though some parts of the site may not work as well. How long we keep your information We keep order and account information for as long as your account is active, or as needed for tax and accounting records, then delete it. Your rights You can ask us to see, correct, or delete the personal information we hold about you, or to stop selling or sharing it, by emailing [support@yourstore.com]. We'll respond within [45] days. Children This site isn't directed at children under 13, and we don't knowingly collect their information. Changes to this policy We may update this policy as our store changes. The date below shows when it was last updated. Contact us Email [support@yourstore.com] or write to [your business address]. Last updated: [month, year]

Cookies and analytics, in plain words

Most small stores use at least two kinds of cookies: ones that make the site work (keeping items in a cart, remembering a login) and ones that measure traffic or run ads (Google Analytics, Meta Pixel, TikTok Pixel).

In the UK and EU, cookies that aren't strictly necessary for the site to function, including analytics and advertising cookies, need the visitor's consent before they're set. Cookies for things like a shopping basket don't need consent. Consent has to come from a clear action, like clicking "accept," not just from someone continuing to browse. ICO

US law doesn't have one federal cookie-consent rule, but California's rules (below) give shoppers there a right to opt out of having their browsing data sold or shared, which in practice covers many ad and analytics cookies.

If you run Google Analytics, Meta ads, or TikTok ads, say so by name in your policy rather than just "analytics tools," since that's what a shopper is actually trying to find out.

Shopify and Etsy notes

Shopify: store policies, including your privacy policy, live under Settings > Policies in your admin. Shopify can generate an automated privacy policy for you from your store's settings, or you can write your own and turn automation off. Shopify Help Center

Etsy: if you only sell through Etsy's marketplace, Etsy's own privacy policy covers the data Etsy itself collects at checkout. You still need your own privacy policy if you run a separate website, collect emails outside Etsy, or run your own ads, since those collect data Etsy's policy doesn't cover.

The California Consumer Privacy Act (CCPA) applies to a for-profit business if it meets any one of these: gross annual revenue over $25 million, it buys, sells, or shares the personal information of 100,000 or more California consumers or households a year, or it gets 50% or more of its annual revenue from selling or sharing personal information. California Attorney General

If CCPA applies to you, California consumers have the right to know what personal information you've collected about them, the right to ask you to delete it, and the right to opt out of its sale or sharing, usually through a clearly posted "Do Not Sell or Share My Personal Information" link. California Attorney General

Most small stores starting out fall under all three thresholds, but check your own numbers, since they change as you grow.

The EU's General Data Protection Regulation (GDPR) applies based on whose data you process, not where your business is based, so a US store with EU customers can still be covered. European Commission

In practice, that means telling EU shoppers what data you collect, why, and on what legal basis (usually "to fulfill your order" or "because you agreed," for marketing), and giving them a way to access or delete it. The UK has its own, near-identical version of this rule after Brexit.

Where to put your privacy policy

Put it where any shopper could reasonably look for it:

  1. Your site footer, linked from every page.
  2. Checkout, near where payment and shipping details are entered.
  3. Any signup form (newsletter, account creation), linked next to the submit button.

Once your privacy and cookie practices are written down on your site, a chatbot like Chatbait can answer "do you sell my data?" or "how do I delete my account?" straight from your own policy page, instead of a shopper having to search for it.

A privacy policy usually sits next to your other store policies: a terms and conditions page, a return policy, and a shipping policy. A FAQ page is a good place to answer the short version of common privacy questions too.

Frequently asked questions

Does a small online store legally need a privacy policy?

There's no single US federal law requiring every website to have one, but California's CCPA and the EU's GDPR both require one if they apply to you, and most payment processors and ad platforms require a privacy policy as a condition of using their service. Posting one plainly is good practice either way.

Do I need a separate cookie policy?

Not necessarily a separate page. Most small stores cover cookies as one section inside their main privacy policy, as in the template above.

Does CCPA apply to every small store?

No. It only applies if you pass one of three thresholds: over $25 million in annual revenue, personal information from 100,000 or more California consumers a year, or 50% or more of revenue from selling personal information. Many small stores aren't covered yet, but check your own numbers as you grow.

Do I need a different privacy policy for EU or UK customers?

You can use one policy that covers everyone, as long as it mentions the rights GDPR and UK data law give those shoppers (access, deletion, and the legal basis for processing their data).

Can I use Shopify's automated privacy policy instead of writing my own?

Yes. Shopify can generate one from your store settings under Settings > Policies. It's a reasonable starting point, but read it and add anything specific to your own tools, like which ad or analytics platforms you use.

Get the template pack by email, plus new templates when we add them.

We'll email you the template pack and new templates now and then. Unsubscribe any time. Privacy.