Privacy Policy, Terms and Cookie Policy for a White Page: What to Write and Why

Legal pages on a site that runs ads are not decoration. Ad networks expect a site that collects data or installs a pixel to explain it to the visitor. It isn't only about review requirements either: an ordinary person who lands on a site with no privacy policy treats it as untrustworthy.

This article describes general practice and ad network rules and is not legal advice: for regulated verticals and specific countries, have a lawyer check the texts.

Why a site with ads needs them

• Meta expects a link to a privacy policy for lead forms, and its Business Tools Terms ask you to explain how the pixel works and to collect cookie consent in the EU.
• Google's user data and personalised advertising rules expect you to disclose data collection and obtain consent in the EEA and the UK. Separately, its misrepresentation policy requires accurate information about the business.
• The visitor. Pages with a policy, terms and contacts are one of the first signs of a real business.

For how these requirements show up in review, see the articles on Meta's requirements and Google Ads.

Privacy policy: what it should contain

A privacy policy answers four questions: what you collect, why, who you share it with, and how a person can influence it. In practice, describe:

1. Who you are. Business name, address, and an email for data questions. They must match the contacts on the site.
2. What data is collected. What a person enters in forms (name, email, phone), and what is collected automatically (IP, browser type, pages, cookies).
3. Why. Replying to a request, running the site, analytics, advertising.
4. Who receives it. Analytics and ad providers: Google Analytics, Google Tag Manager, Meta Pixel. Name each one that is actually on the site.
5. How long it is kept and how to delete it.
6. The visitor's rights. Access, correction, deletion, withdrawal of consent; in the EU and UK this is a direct GDPR requirement.
7. The date of the last update.

The policy should be its own page on the site, not a PDF and not a link to someone else's document.

Terms (terms of use)

Terms set the rules for using the site. For a white page, these sections are enough:

• who runs the site and how to contact them;
• what the site does and what it doesn't promise (informational nature, no guarantees);
• limitation of liability;
• rules for users (no abuse, intellectual property);
• governing law and the update date.

What the terms say should match what the site shows: if the page sells a service, the terms shouldn't say "this site is purely informational".

Cookie policy and banner

A cookie policy explains which cookies the site uses and how to opt out. Four categories are usual: necessary, functional, analytics and marketing. The banner should:

• appear on the first visit, in a language the visitor understands;
• let people accept, decline or customise categories (for the EU and UK);
• link to the cookie policy;
• keep analytics and the pixel off until consent if you target a country with an opt-in regime.

Meta's Business Tools Terms ask the pixel notice to lead to an explanation of cookies and how to opt out. So a cookie policy and banner are needed even when "there's just a pixel".

Common mistakes

• A policy exists, but it doesn't mention the installed scripts. GTM, GA4 and Meta Pixel are on the page, and the text only names Google Analytics.
• Different names and addresses in the policy, terms and contacts.
• A policy in a different language than the site.
• Someone else's text with another company's name. It's easy to spot and hurts trust.
• A banner with no link to the cookie policy, or with no way to decline where one is required.
• A policy as a PDF or as a link to an outside site.
• No update date.

How it works in WhiteCraft

Every WhiteCraft site includes a privacy policy, terms and a cookie policy: they are built in every mode, including "Landing". The texts are generated in the site's language, with the business name and contacts of that site, and carry an update date.

For the cookie banner:

• the language and texts follow the site's language, and the banner links to the cookie policy;
• for opt-in countries (the EU, UK, Switzerland, Norway) the banner lets people choose categories: necessary, functional, analytics, marketing; analytics and the pixel, if you set them, wait for explicit consent;
• other countries get a simpler banner.

If you set a GTM, GA4 or pixel ID, the health score checks whether they are mentioned in the privacy or cookie policy and warns if not. The other checks (required pages, language, contact consistency) are described on the features page.

What stays with you: a legal review of the texts for your vertical and country, keeping the business details current, and following the ad networks' rules. Whether a template text fits your case is a call for you and a lawyer, and the approval decision is made by the ad network.

Checklist

• Privacy policy, terms and cookie policy are separate site pages, not PDFs
• Names, addresses and emails are identical across all documents and contacts
• The policy names every installed script: GTM, GA4, pixel
• A cookie banner that links to the cookie policy; with category choice for the EU and UK
• The documents are in the site's language
• An update date is present
• The terms don't contradict what the site shows

The general pre-launch list is in the white page checklist, and the rejection reasons are in why a white page gets rejected.