What information should my privacy policy include regarding email?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
When someone hands over their email address, they're trusting you with something personal. Your privacy policy is where you explain what you do with that trust. Most people won't read it word for word, but regulators will, and subscribers absolutely will if something feels off.
Here's what your privacy policy needs to cover on the email side:
What data you collect and how. Be specific. It's not just an email address. You're likely also collecting the person's name, IP address at signup, engagement data (opens, clicks), and sometimes device or location info. Say where you get it from too: signup forms, checkout flows, lead magnets, third-party integrations.
Why you're collecting it. Marketing emails, transactional messages, personalization, re-engagement campaigns. If you're using the data for anything beyond sending emails, say so. Subscribers shouldn't have to guess.
Who else sees it. Your email service provider processes subscriber data on your behalf. So does your CRM, your analytics platform, any data enrichment tools you use. Name the categories at minimum ("email platform", "CRM", "analytics") and link to their sub-processor pages if you want to go further.
How long you keep it. What happens to someone's data when they unsubscribe? Do you delete it, suppress it, or archive it? There's no single right answer, but there needs to be an answer. (Most senders keep suppressed unsubscribes to avoid accidentally re-adding them, which is actually subscriber-protective, not sneaky.)
Tracking disclosures. If you use open tracking pixels or click tracking, say so. It's standard practice, but subscribers in certain jurisdictions have a right to know.
How subscribers can exercise their rights. Unsubscribe process, data access requests, correction requests, deletion requests. Include a real contact method, not just a generic form. GDPR requires you to name yourself as the data controller and state your legal basis for processing (consent or legitimate interest). CCPA requires you to cover consumers' rights to opt out of data sales. If either law applies to your audience, these aren't optional additions.
The tone matters as much as the content. A privacy policy written in plain language signals that you actually want subscribers to understand it. One written in dense legalese signals the opposite. You don't need a lawyer to make it readable, though having one review it is worth doing if you're processing data at any real scale.
And if you're not sure your current policy covers all of this, the next question in this series on how to inform subscribers about data use gets into the practical side. And if you'd rather talk through your specific setup, our SOS hotline is free.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
