Privacy policy for an app in the US: the link, the effective date and the Do Not Track line

Updated Oct 27, 2026 · Pewterkit Guides

If your app collects personal information from people in California, California's Online Privacy Protection Act (CalOPPA) asks you to post a privacy policy on your site. That policy states its effective date and, if your site collects information about visitors' activity over time and across other sites, how you respond to browser "Do Not Track" signals. The quickest path: link the policy from your homepage footer, put "Effective date:" at the top, and add one short Do Not Track paragraph. The template below gives you all three.

What CalOPPA asks a privacy policy to include

California Business and Professions Code section 22575 says an operator of a commercial website or online service that collects personally identifiable information from California residents "shall conspicuously post its privacy policy". Section 22575(b) lists what the policy covers. In plain English:

CalOPPA item What it means for your app
(b)(1) Categories of information and who you share it with List what you collect (email, name, payment details, usage data) and the kinds of companies that receive it (hosting, payments, analytics)
(b)(2) Review and correction process, if you offer one Say how a user can see or change their data
(b)(3) How you tell users about material changes For example, an email or a notice in the app
(b)(4) "Identify its effective date" A visible "Effective date" or "Last updated" line
(b)(5) How you respond to "do not track" signals, if you collect data on activity across sites One paragraph; see below
(b)(6) Whether other parties may track users across sites Name the analytics or ad tools that can do this

Because CalOPPA covers anyone collecting data from California residents, it is the practical baseline for most US apps, wherever the founder lives.

The Do Not Track paragraph

Item (b)(5) asks you to "Disclose how the operator responds to Web browser 'do not track' signals or other mechanisms" that give people a choice about tracking over time and across sites, "if the operator engages in that collection". Most apps with analytics or ad pixels include the paragraph anyway. You can describe what you do honestly, including that your app does not change its behavior. Item (b)(7) also lets you meet this with "a clear and conspicuous hyperlink" to a description of a choice program you follow.

If you honor Global Privacy Control, say so here too; see Global Privacy Control: what it is and how to honor it.

A template you can adapt

Privacy Policy
Effective date: [Month Day, Year]

What we collect: [email address, name, payment details handled by our
payment processor, usage data from analytics].
Who we share it with: [hosting provider, payment processor, email
provider, analytics provider]. [We do not sell personal information.]
Your choices: email [privacy@yourdomain.com] to see, correct or delete
your information.
Changes: we will post the new version here with a new effective date
and [email you / show a notice in the app] for material changes.
Do Not Track: [Our app does not respond differently to browser Do Not
Track signals.] OR [When your browser sends a Do Not Track or Global
Privacy Control signal, we turn off advertising trackers for you.]
Third-party tracking: [Analytics tool] may collect information about
your activity over time and across websites.
Contact: [business name, email].

This is a plain-English starting point you can adapt; for anything specific to your business, a lawyer's quick review is worth it.

"Conspicuously post" is about placement. The California Attorney General's guide suggests "a conspicuous link on your homepage containing the word 'privacy'". A text link labeled "Privacy" or "Privacy Policy" in the footer of your homepage, on its own page (not a PDF), is the common pattern. Keep the same address over time so the links in app stores and emails keep working.

What Pewterkit Check looks for

When a free check reads your homepage, it looks for a privacy link in the HTML or app routes and opens that one page to look for an effective or last-updated date and a Do Not Track statement. It reports what it can see on the public page; the wording of your policy stays your call.

FAQ

Does a privacy policy need an effective date?

Under CalOPPA, yes: section 22575(b)(4) says the policy must "Identify its effective date." Put it at the top so readers see it first.

What should the Do Not Track section say if my app ignores the signal?

Say exactly that. CalOPPA asks you to disclose how you respond, so "Our app does not respond differently to Do Not Track signals" is a valid answer. If you turn trackers off for those visitors, describe that instead.

My app collects no personal data. Do I still need a policy?

Once you add sign-up, a contact form, payments or analytics, you collect personal information. A short policy saying what you collect (even "only your email") is quick to write and ready for app stores too.

Where should the privacy policy link go?

In the footer of your homepage, as a normal web page. App stores such as Google Play also ask for a public privacy policy URL, so one page serves both.

Sources

  1. California Attorney General: Making Your Privacy Practices Public (PDF) — read 27 Oct 2026: CalOPPA guidance, conspicuous "privacy" link, effective date, Do Not Track disclosure; appendix reproduces Bus. & Prof. Code sections 22575 to 22579, items (b)(1) to (b)(7)
  2. Global Privacy Control — read 27 Oct 2026: browsers that send the signal

How this page was made: drafted with AI from the sources listed, reviewed by Pewterkit. Docs checked Oct 27, 2026. Spotted something out of date? Tell us.

Related guides