84% of Small Business Websites Have No Link to a Privacy Policy

A parent fills in the enquiry form on a local daycare's website, typing her name, phone number and her child's age. Nowhere on the site does it say who will see those details, how long they are kept, or whether they are shared. There is no privacy policy to click.

A privacy policy is a page that explains what personal information a website collects, why, and what happens to it. Small business websites collect personal information in many ways: a contact form, a booking widget, a newsletter sign-up, analytics that record visits, or an advertising pixel that tracks them. Many ad platforms and app stores expect a posted privacy policy, and for visitors it is a trust signal, one of the things a careful person looks for before typing in their details.

83.6% of small business websites have no link to a privacy policy page, about five in six. The smallest websites are the least likely to have one, at 94% for sites of 3 to 5 pages, and churches, hair salons, daycares and tattoo shops go without one on more than 95% of their websites.

In September 2026 we checked the websites of US small businesses listed on Google Business Profiles in 56 industries. The main figures come from 1,612 websites of 3 to 19 pages, where we followed every link from page to page and so saw every page on the site. We also checked a wider group of 5,120 small business websites, including larger ones, and split the results by industry and by the number of pages on the site.

A site counts as having a privacy policy link when it links to a privacy policy page on its own site. Industry figures cover industries with at least 20 websites; the healthcare group combines dentists, clinics and med spas.

16.4% of small business websites link to a privacy policy, about one in six. Across the wider group of 5,120 small business websites, the share with a privacy policy page is lower still, at 13.4%. Both figures point the same way: a privacy policy is the exception on a small business website, not the norm.

The gap matters because data collection is common. A contact form, a booking tool or a free analytics script is on many business websites, and each one gathers personal information the moment a visitor uses the site. A website without a privacy policy asks visitors to hand over details without saying what happens to them.

Small business websites of 3 to 5 pages lack a privacy policy link 94% of the time. The rate falls to 84% for sites of 6 to 10 pages and 79% for sites of 11 to 19 pages. Small brochure sites, a homepage, an about page, a services page and a contact form, are the least likely to include any legal pages at all.

That pattern follows how small sites are built. A five-page site is often set up once from a template, and a privacy policy is not one of the pages the template ships with. Adding pages makes a privacy link more common, but even among sites of 11 to 19 pages, nearly four in five have none.

Churches have the highest rate of any industry, with 96% of church websites linking to no privacy policy. Hair salons follow at 95.7%, then daycares and tattoo shops at 95.5% and massage therapists at 94%. Every industry in the top ten is above 91%.

Several of these collect sensitive details through their websites. Daycares take enquiries about children, salons, spas and massage therapists take bookings with names and phone numbers, and wedding venues ask for dates, budgets and guest counts. Visitors to these sites are handing over the kind of information a privacy policy exists to explain.

Healthcare businesses do better than most. Optometrists, at 61.8%, and dentists, at 63.6%, have the lowest rates of any industry, and across dentists, clinics and med spas combined, 70.7% of websites have no privacy policy link.

That still leaves seven in ten healthcare websites without a privacy policy link, even though patients often book appointments through them. A practice that already gives patients a privacy notice in the office can publish the same commitment online in an afternoon.

If your website has a contact form, booking tool, newsletter sign-up, analytics or advertising pixels, publish a privacy policy that says what you collect, why, how long you keep it and who you share it with, and link to it in the footer of every page. Template generators can get you started; have a lawyer review it if you handle health, financial or children's information.

Put the link near your forms as well. A short line under a form, such as "We never share your details. See our privacy policy.", reassures a visitor at the moment they decide whether to send it. Review the policy whenever you add a new tool that collects data, such as a chat widget or a new ad platform.

Legal pages are easiest to get right when a site is built. Choosing small business web design that includes a privacy policy link, form notices and footer legal links from launch saves adding them later, one page at a time.

Embed this research

Cite this study