What Must A Privacy Policy Contain?

For a long time (until today) I thought that a privacy policy was an obligatory part of any online website to declare to the public how public data is gathered (if it is) and how it is (if it is) handled or used. Though different sites say different things, having a privacy policy on your page is not mandatory at all. People include them simply because it's a practiced practice, and they have (as I had) the impression that it was needed. Don't get me wrong, many sites really do need privacy policies, but most personal sites do not.

If you run a business it may be wise to have a policy in case you collect information and handle it in such a way that it is required you notify the user of it. At the same time, creating a privacy policy is a guideline made as much for the visitor as for yourself, and if you do not follow your own policy, then the real trouble could fire up. So don't create a policy just to have one, and be certain that you'll follow the regulations you create if you do. If you use third-party services, they may require that you have a privacy policy. Apart from that, you do have an obligation to adhere to the Children’s Online Privacy Protection Act of 1998 (COPPA), and if you collect data from users of California, there's the California Office of Privacy Protection you need to be aware of. In different countries, different laws may apply, but most don't have any laws regarding privacy policies on websites. Most people don't really care or know about privacy policies anyway, except for the website owners.

I guess I don't need one. This is a personal website, completely non-commercial and I'm not collecting any data from users in Calfornia either. But what happens if a user from California posts a comment? What then? The topic of privacy polices is rather unclear, and it would be nice with some W3C regulations that clearly state what you must have. For now, I'm just posting my 29 cents. If you're interested, there's plenty of debate to look up.