When does my web page need a privacy statement?
Purpose. Privacy statements exist to inform users of website practices regarding collection and use of user information, whether that collection is about their computing set-up or about them personally. University policy dictates that there shall be privacy statements (or links to privacy statements) on particular kinds of web pages. University policy does not dictate the specific ways that privacy needs to be handled, since university web pages serve so many different functions. The Privacy Policy Generator can be used to easily construct an appropriate statement by answering questions about the site’s procedures and practices regarding collected information.
What pages need a privacy statement? By policy (Policy 7030), the following types of sites need a privacy statement.
- The main page for each distinct server domain name.
For example, “computing.vt.edu” should have a privacy statement or a direct link to the pertinent privacy statement. Subsidiary pages that are informational only and do not meet the next criterion would not need their own statements.
Static web pages that serve only to provide information will generally need a statement/link only at the domain name level.
- Pages likely to be browsed directly.
These pages constitute a gray area since one cannot always manage how users get to your pages! However, the intent is to be sure that website users who take alternate paths to common sites have the opportunity to also be informed about privacy, particularly about cookies and related devices. Web page owners and webmasters should consider how their pages are marketed. Subsidiary pages that have been deliberately marketed by directly point to the URL in an email or newsletter or highly visible website should provide the user an opportunity to understand the privacy procedures that apply.
- Any page that collects personal information.
When you ask the user to provide information, it is important to tell that user how the information will be used. What kinds of personnel will see it? How will it be managed and kept secure? Any of the following should have a privacy statement/link, either on the page in question or on the gateway page to the form.
- Any web form filled out and submitted online
- Any web survey filled out and submitted online.
- Any e-commerce transaction.
- Any page that collects computing information.
When you ask the computer to provide information, it is important to tell that user how the information will be used. Among those pages that would need a privacy statement/link are:
- Those designed to keep information about the computer configuration in order to keep information as the user moves from page to page (maintaining state).
- Those that permits the user to customize the page to his or her preferences.
Open the Privacy Statement Generator (in a new window).
8
12
