Cost of a Privacy Policy

As a business owner, you probably have (or should have) a lot of questions regarding the legal aspects of running a successful business. One of the most important questions that you'll have to deal with early on will be about your Privacy Policy agreement. More specifically: how much will it cost you to write a Privacy Policy for your business?

It's important to remember that having a Privacy Policy a legal requirement under privacy laws that work to protect your customers' privacy. If you collect personal information, you're required to have a Privacy Policy. Even if you don't collect personal information, you should have one anyway.

Getting a Privacy Policy agreement for your business can be as easy as generating a generic one or having an attorney write a custom one based on your business' specific needs.

In this article, we'll go into the details of which factors directly influence the cost of a Privacy Policy.

But before we begin, let's quickly go over what a Privacy Policy is.

What is a Privacy Policy?

A Privacy Policy is a legal document that outlines the different ways a business intends on using their users' personal information. At the very minimum, it should cover how the business handles each piece of information the company collects whether it's a name, email address, or any form of financial information.

You'll make this document available on your website and within your mobile app so your users can find out things like what information you're collecting from them and how, as well as what you plan to do with that information and how they can control any of this.

Visit your favorite website, scroll to the footer, and you're almost certain to see a Privacy Policy linked there.

Why Privacy Policies Don't Have a Fixed Price

The problem with drafting Privacy Policy agreements is that there isn't a fixed cost for them. What works for one business, won't work for the next one. This is because every business has a different set of needs that must be taken into account when writing its Privacy Policy.

Usually, this is based on factors like what kind of information your users are required to enter, their demographics, what you plan on doing with that information, etc.

That said, what you can do is identify the factors that are important to you and then find a solution that's specific to your business needs.

Your Privacy Policy should be customized to handle the different privacy issues that are relevant to your product or service, your consumer base, and the information you require them to provide.

Since Privacy Policies should (ideally) be business-specific, there aren't really one-size-fits-all solutions. Understandably so, the cost of a Privacy Policy agreement varies and can only be expressed in terms of a ballpark estimate or price range - especially without getting into business-specific requirements. We'll look at this in the following section.

What we can do, however, is highlight the key variables that determine the cost of a Privacy Policy and explain them through examples. This way, you'll have a framework for how the costs associated with writing policy agreements vary.

Business Website vs. Mobile App vs. Desktop App

Depending upon which platform - website, mobile app, desktop app - you're operating your business through, the length and complexity of your Privacy Policy agreement will differ.

For instance, if you have a retail business with an online presence then your business industry is less likely to fall under restrictive laws making it simpler than a web application that is targeted at children and requires them to enter their personal information through a web page.

And if you're running your business through multiple mediums i.e. you have an e-commerce website and an app that allows users to buy from you, then you're going to need to include clauses for both mediums in your Privacy Policy agreement.

For example, the Privacy Policy on Amazon's website includes a clause for the information the company gathers through its mobile app. It explains that when you use the Amazon mobile app, the company receives information about your location and mobile device which is used to provide you location-based services.

Basically, when you're writing a policy agreement for the multiple platforms that you're running your business through, you want to make sure you're covering all the bases by referring to all of them.

User-Generated Content Sites

Policies written for websites that host user-generated content (think social media accounts or blogs that allow users to leave comments) tend to be more expensive because they require specific clauses concerning intellectual property, liability, privacy, and acceptable use.

For instance, Instagram's Privacy Policy includes a user content section in its clause about what information it collects, which includes photos, comments, and other materials that users post. A section like this wouldn't have to be considered or included in a Policy for a company that doesn't do such things.

In most cases, websites and mobile apps that encourage their consumers to publish content or upload media files will have to address their end user's rights and their own rights for that content.

For example, Reddit protects its content through intellectual property laws and explains which rights their users retain and which rights they grant to the content that users submit to the platform.

Communications Clauses

Some websites include a communications clause in their Policy that explains how the company collects and uses information for communications purposes.

An example of this would be Canva's Privacy Policy which includes paragraphs letting users know that contact information will be used to send emails about technical issues as well as relevant offers and services.

Demographic-Specific Clauses

Companies may be required by state law to include specific clauses in their Privacy Policy for residents of those areas.

Forever 21's policy agreement, for example, has two separate clauses for California Residents and EU Residents that informs them of their rights and the international transfers of EU customers' personal information respectively.

Another example of an area-specific clause can be found in CoSchedule's Privacy Policy.

Third-Party Accesses

If your business model allows third-parties to access your consumers' personal information or if you collect information through third party services, you need to include this information in your Privacy Policy.

Some of the most common third-party entities that access consumer information include marketers/advertisers and social networking and analytics applications.

For example, the popular web application Bitly says in its Privacy Policy that it collects information (like authentication tokens) from your Facebook and Twitter.

You don't have to name third parties specifically, but just make it known that this is happening.

Retention of Personal Information

A data retention clause typically covers what data you're retaining and for how long.

HubSpot writes in their policy agreement that it retains its customers' personal information if there's an ongoing legitimate business need to do so.

In addition to this, it includes information about how customers can request to have their information deleted earlier.

Price Considerations for Businesses With Standard Legal Rules

The low end of the price range will tend to cover simple business models that are more likely to have standard legal rules. These are typically tried-and-tested businesses such as:

• An e-commerce store selling basic goods
• An online reservation site for a hotel/restaurant
• Mobile apps like cookbook apps, fitness apps, productivity apps, etc.

Price Considerations for More Complex Businesses

If your business has legal requirements that are very complicated or is likely to be full of hidden dangers or liabilities then the cost for your policy agreement will probably be on the higher-end of the spectrum. These businesses have legal requirements that constantly undergo changes due to external factors like social, technological, economic, and political influences. Some examples include businesses operating in the:

• Financial technology niche
• Health sector
• Employment sector
• Children's sector

Conclusion

A number of factors determine the total cost of a Privacy Policy:

• Type of business - The type of business you're running and which channels you're using i.e. business website, mobile app, desktop app, or a combination of these.
• User generated content - Whether or not you host user generated content on your website.
• Consumer demographics - Does state law require you to add clauses that are specific to their residents?
• Third-party accesses - Do you allow third-parties to access consumers' personal information?
• Data retention - Do you store customers' personal data after they've deleted their accounts or are you dealing with a lot of data that you need to retain or delete appropriately?

However, the final cost will be unique to your business as no two businesses are exactly alike, nor will any two Privacy Policies be.