Does My Small Business Website Need a Privacy Policy? A North Carolina Guide

By Benny U. Enemchukwu

Short Answer

North Carolina has no general statute requiring every business website to post a privacy policy. The comprehensive consumer privacy bills introduced in the 2025-2026 legislative session have not been enacted. You may still need one. California law requires commercial websites that collect personally identifiable information from California residents to post a privacy policy. Federal rules apply to sites directed to children under 13. And many online services require one in their own terms. Whatever you post must be accurate.

Where North Carolina Law Stands

Several comprehensive consumer privacy bills were introduced in the 2025-2026 session of the General Assembly, including House Bill 462 and Senate Bills 757 and 1022. According to the General Assembly's bill pages, each remains in committee, so none is law.

North Carolina does have privacy laws that matter to small businesses. Under the Identity Theft Protection Act, a business that owns or licenses personal information of North Carolina residents must notify affected people of a security breach without unreasonable delay (G.S. 75-65(a)). When it gives that notice, it must also notify the Consumer Protection Division of the Attorney General's Office (G.S. 75-65(e1)). North Carolina also prohibits unfair or deceptive acts or practices in or affecting commerce (G.S. 75-1.1).

California's Rule Reaches Many North Carolina Websites

California Business and Professions Code section 22575 requires an operator of a commercial website or online service that collects personally identifiable information about individual consumers residing in California to conspicuously post a privacy policy. The policy must identify the categories of information collected and the categories of third parties it may be shared with. Among other items, it must also describe any process for reviewing and requesting changes to that information, and explain how the site responds to "do not track" signals. A North Carolina business with a contact form, newsletter sign-up, or online store may well collect information from California visitors.

Websites Directed to Children

The federal Children's Online Privacy Protection Rule applies to operators of websites or online services directed to children under 13, and to operators with actual knowledge that they collect personal information from a child. Those operators generally must post notice of their information practices and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information (16 C.F.R. § 312.3). If your site is aimed at children, a general-purpose policy is not enough.

Accuracy Is the Real Legal Issue

The Federal Trade Commission Act declares unfair or deceptive acts or practices in or affecting commerce unlawful (15 U.S.C. § 45(a)(1)), and North Carolina's statute uses parallel language (G.S. 75-1.1). A privacy policy is a public statement about your business. A copied policy that promises things you do not do, or leaves out tracking you actually use, creates risk instead of reducing it.

What a Website Privacy Notice Should Cover

What information you collect, through forms, accounts, purchases, cookies, and analytics.
How you use it.
Who you share it with, such as payment processors, email services, and advertising partners, described by category.
Cookies and tracking technologies, and how visitors can limit them.
How you respond to "do not track" signals.
How visitors can ask to review or correct their information, if you offer that.
How you protect and retain information.
Whether the site is directed to children.
How to contact you, and the effective date of the notice.

Website Terms Are a Separate Document

A privacy notice describes how you handle information. Website terms set the rules for using the site: ownership of content, acceptable use, disclaimers, limits on liability, and governing law. If you sell online, terms of sale also address payment, shipping, returns, and cancellations. The two documents should be consistent with each other and with how your business actually operates.

If Your Site Feeds an Email List

Many small-business websites collect email addresses for newsletters or promotions. The federal CAN-SPAM Act sets rules for commercial email, separate from your privacy notice. A commercial email message must:

Include a functioning return email address or other internet-based way for recipients to opt out of future messages (15 U.S.C. § 7704(a)(3)).
Clearly identify itself as an advertisement or solicitation, unless the recipient gave prior affirmative consent (15 U.S.C. § 7704(a)(5)).
Give clear notice of the opt-out opportunity (15 U.S.C. § 7704(a)(5)).
Include a valid physical postal address of the sender (15 U.S.C. § 7704(a)(5)).

Your privacy notice should describe how you use the email addresses you collect. Your email practices should match it.

Before You Use a Generator or Template

Start with an inventory: every form on your site, every plugin or embedded tool, every analytics or advertising tag, and every service that receives visitor data. A template cannot know what your site does. The privacy notice has to match that inventory. Update it when you add new tools.

Keep It Current

Put a review date on your calendar. Revisit the notice whenever you add a new form, switch email or payment services, start advertising online, or begin selling to a new audience. Update the effective date when you change it. Keep a copy of earlier versions so you can show what your notice said at any point in time.

My Website Legal Essentials service provides a privacy notice and website terms for one small-business website. If you have a narrower regulatory question, see the Focused Compliance Diagnostic. To start, request a free 15-minute call.

This article is general information, not legal advice. Reading it does not create an attorney-client relationship.

Sources

Current as of November 2026.