Data is easy to collect and hard to un-leak. Contact forms, checkout pages, analytics tools and email platforms all gather information about real people. Treating that information carefully is part of your reputation (Lesson 1), and in many cases it is also the law.
Privacy law varies a great deal by country and state, and it is changing quickly. This lesson explains the main concepts and the laws small builders most commonly meet, mostly from a U.S. perspective with notes on the EU and UK. It is education, not legal advice. When in doubt, collect less, say what you do honestly, and ask a qualified professional.
01Why data is a responsibility, not just an asset
Businesses love data. But every piece you collect also creates duties: to protect it, to use it only for stated purposes, and to delete it when you no longer need it. The safest data is the data you never collected. Privacy professionals call this data minimization: collect only what you need, keep it only as long as needed, and make sure everyone involved would be comfortable with how you use it.
02What counts as personal data
"Personal data" or "personal information" generally means information that identifies or can reasonably be linked to a particular person. It is broader than people expect:
If you can tell that "visitor #482 came back three times and bought the blue planner," that is personal data once it can be tied to an individual. Photos, voices and customer messages count too.
03The laws at a glance
| Law or rule | Where it applies | What it means for a small builder |
|---|---|---|
| GDPR and UK GDPR | Applies to processing personal data of people in the EU/UK when you offer them goods or services or monitor their behavior, wherever you are based | You need a lawful basis (such as consent or contract), clear notices, honored rights (access, deletion, objection) and appropriate security. Fines can be large. |
| CCPA/CPRA and other U.S. state privacy laws | California and a growing number of states, often with thresholds for revenue or number of consumers | Rights to know, delete and opt out of sale or sharing for covered businesses. Even if you fall below a threshold, customers expect the same respect. |
| CAN-SPAM Act | U.S. commercial email | Honest sender info, non-deceptive subjects, identify ads, include a postal address, honor opt-outs. Details below. |
| COPPA | U.S. online services directed to children under 13, or that knowingly collect their data | Verifiable parental consent and extra duties. Details below. |
| TCPA and similar | U.S. marketing calls and texts | Generally requires prior consent for marketing texts. Do not text people who have not agreed. |
| Breach-notification laws | All U.S. states, many countries | If personal data is exposed, you may have legal duties to notify affected people and authorities. |
You do not need to become a privacy lawyer. You need to know which questions to ask: who are my users, where are they, what do I collect, why, and what do I promise?
04Running an honest email list
The CAN-SPAM Act covers commercial email in the United States, and its rules are a good baseline everywhere. According to the FTC's guide, every commercial message must:
- Use accurate header information. The "From," "To" and routing details must identify the real sender.
- Use a non-deceptive subject line that reflects what is inside.
- Identify the message as an ad where it is one.
- Include your valid physical postal address. A street address, a registered PO box or a private mailbox works.
- Tell recipients how to opt out clearly and easily.
- Honor opt-outs promptly: within 10 business days, with an opt-out mechanism that works for at least 30 days after sending, requiring no more than a reply email or one web page visit, and no login or fee.
- Monitor anyone sending on your behalf. You remain responsible for your email service provider and affiliates.
- Collect addresses with clear, specific consent: say what you will send and how often.
- Never buy or scrape email lists. They damage deliverability and trust, and are illegal in many places.
- Use a double opt-in if you can, and keep proof of when and how someone signed up.
- Do not add customers to a marketing list just because they bought something, unless you told them you would.
- Make unsubscribing painless. A frustrated subscriber becomes a spam complaint.
05Cookies, analytics and trackers
Most sites load tools you did not write: analytics, fonts, video players, chat widgets, ad pixels. Each can set cookies or send visitor data to a third party. This matters because:
- Laws like the EU's ePrivacy rules and GDPR generally require consent before non-essential cookies or trackers are used on people in those regions.
- Third parties may use visitor data for their own purposes. You are responsible for knowing what you added.
- Your privacy statement must match reality. Claiming "we don't track you" while running ad pixels is a deceptive statement, regardless of intent.
Practical approach: list every third-party script, decide whether you truly need it, choose privacy-respecting options when you can, add a consent tool where required, and describe what you use in plain language.
06Your privacy policy
A privacy policy is a promise. A good one is accurate, readable and specific. At minimum it explains:
- What personal information you collect, and how (forms, cookies, payments)
- Why you collect it and what you do with it
- Who you share it with (payment processors, email services, analytics)
- How long you keep it and how people can ask you to access or delete it
- How people can contact you
A copied policy describes someone else's practices. If it says things that are not true of your site, you have made a false statement to your visitors. Write your own from your own data inventory, or use a reputable generator and check every line.
07Children's data
COPPA applies to online services directed to children under 13, and to general-audience services with actual knowledge that they collect personal information from under-13s. The FTC finalized updates to the COPPA Rule in 2025. Key points, according to FTC guidance:
- You generally need verifiable parental consent before collecting personal information from a child under 13.
- Parents must receive direct notice that explains your practices, including whether and why data is shared with third parties.
- Operators must keep a written data-retention policy, may keep children's data only as long as reasonably necessary, and must maintain a written information security program.
- Compliance with the updated provisions has a deadline of April 22, 2026, so these requirements are in force now.
The simplest compliant strategy for most small builders is to design for adults and teens, state a minimum age honestly (this site requires accounts to be 13 or older), and not collect data from children. Do not use an age gate you do not enforce, and delete data if you learn a child's data was collected.
08Security habits that protect everyone
Most small-business breaches come from basic problems, not elite hackers. These habits stop most of them:
- Use a password manager and unique passwords. Turn on multi-factor authentication for email, hosting, domain, payment and social accounts.
- Keep software updated: your CMS, plugins, themes, libraries and devices.
- Use HTTPS everywhere and a reputable host.
- Do not store payment card numbers. Use a payment processor that handles them.
- Limit access. Give collaborators only what they need, and remove access when projects end.
- Back up, and test restoring. A backup you have never restored is a hope, not a plan.
- Know your breach plan. Decide in advance who you will contact, how you will investigate and how you will notify affected people.
- Beware phishing. Verify unexpected requests for passwords, payments or file access by a second channel.
09People in your work
Data protection also covers things that are not forms. Before you use someone's photo, message or work in your project:
- Get permission (ideally written) to use a person's likeness, voice or story in marketing.
- For recognizable people in photos used commercially, use a signed release or a license that covers it.
- Don't post screenshots of customer messages without permission. Remove names and identifying details if you need to illustrate a point.
- Treat client information as confidential. If a client's data is in your possession, only use it for their project and delete it when you are done.
Should you collect it?
Build your data inventory
List the types of personal data you collect (or would collect) in a real or imagined project. Answer for each: why, where it lives, and when you will delete it.
| Data I collect | Why I need it | Where it lives | When I delete it |
|---|---|---|---|
Example: "Buyer email" / "Deliver the download and receipts" / "Payment processor and my email tool" / "Delete marketing consent on request; keep receipts as the law requires".
Saved automatically Saved
10Check your understanding
Lesson 7 quiz
11Key terms
Go deeperA closer look at GDPR basics
GDPR requires a lawful basis for processing, such as consent, performance of a contract, legitimate interests or a legal obligation. It gives individuals rights including access, correction, erasure, restriction, portability and objection. Organizations must respond to requests, keep records, secure data, and report certain breaches to authorities within tight deadlines. If you serve EU or UK customers, consider appointing a contact point and being careful with tools that send data outside those regions. Check the official guidance from the relevant data-protection authority.
Go deeperIf you sell to businesses
Business customers often ask for a data processing agreement, security details and sub-processor lists. Having a clear data inventory, a plain-language privacy and security page, and a simple process for handling data requests helps you pass those checks, and win larger clients.
Key takeaways
- Personal data is broader than names and emails: IP addresses, cookie IDs and photos count.
- Collect only what you need, protect it, and delete it when you no longer need it.
- CAN-SPAM requires honest sender info, honest subject lines, ad identification, a postal address and easy opt-outs honored promptly.
- Your privacy statement must match reality. Never copy a policy that describes someone else's practices.
- COPPA sets strict rules for under-13s. The simplest safe course is not to collect children's data.
- Basic security, such as MFA, updates, backups and a payment processor, prevents most breaches.
Official sources and further reading
Finished this lesson?
Mark it complete to save your progress to this device and your account.
This lesson is general education, not legal advice. Laws and platform rules differ by place and change over time. For a specific situation, talk to a qualified professional and read the terms of each platform you use. Last reviewed 2026-11-02.