Privacy policy for the web: what the web expects
The privacy policy requirements for shipping on the web, where the URL goes, and what gets a submission rejected.
Where the URL goes
On the web there is no console to fill in, so the requirement is practical: a link in your footer that a regulator or a user can find without hunting.
What goes wrong on the web
- No cookie notice on a site that loads analytics before consent.
- A policy that names a company that no longer exists.
- No way to contact a human about data.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Can I use the same policy for both stores?
Yes, one policy can serve both, as long as it covers everything both apps do. What cannot be shared is the store metadata: labels and data safety answers are entered separately and both have to agree with the policy.
Does the URL have to be on my own domain?
No. It has to be public, stable and reachable. A hosted page is fine, and often more stable than a page on a domain that lapses.