We’re a nonprofit. Does our website need a privacy policy?

Yes, California nonprofit organizations are subject to privacy laws, including the California Online Privacy Protection Act (CalOPPA), which requires operators of commercial websites or online services that collect personally identifiable information from California consumers to post a conspicuous privacy policy on their website. While nonprofit organizations may not be explicitly stated in the law, if your nonprofit website collects personal information from California residents, it’s advisable to have a privacy policy to comply with CalOPPA and to demonstrate your commitment to protecting users’ privacy. Additionally, having a privacy policy can help build trust with your website visitors and donors.

The key elements of a policy include:

• Identification of the Operator – that’s probably your nonprofit.
• Types of Personally Identifiable Information (PII) Collected – for example, names, email addresses, etc.
• Purpose of Data Collection – why you collect the information and what you do with it
• Third-Party Sharing – do you share it? If so, why and to whom
• User Rights – especially how they can change or delete their data
• Data Security Measures – how you protect the data
• Policy on Cookies and Tracking Technologies
• Changes to the Privacy Policy – how you notify of changes.
• Contact Information – how can a user contact you.
• Effective Date – date the policy went into effect.

For further reference: Making Your Privacy Practices Public from the California Department of Justice