You can’t write a good Privacy Policy until you understand the company’s privacy and data practices. In this article, Justin Sha explains what a Privacy Policy fundamentally is, by focusing on their importance in the context of consumer apps, with social dating apps as the primary example. Privacy Policies are notices about a company’s data practices. They are important because they are required by law. A poorly drafted Privacy Policy increases the risk of litigation, consumer disputes, as well as fines and other regulatory consequences in part due to a complex web of privacy regimes, including federal law, the distinct laws of each of the 50 states like the California Privacy Rights Act (CPRA), as well as important international laws including General Data Protection Regulation (GDPR) in the EU as well as UK GDPR for the United Kingdom. There’s a lot here.
For anyone drafting a Privacy Policy, Justin Sha recommends taking a structured approach. First, conduct a preliminary review of existing materials to inform yourself about the company and relevant product. Second, understand current data practices, identify relevant legacy practices and retained data, and separately understand any planned changes to the product.
Ask:
- What data is the company collecting from consumers?
- What is the company doing with that data?
- Who else will receive a copy of that data?
- With respect to the data practice or the legal policy, what should be changed?
What is a Privacy Policy?
A Privacy Policy tells users how a company handles the personal information of their users when they use the company’s app, visits the company’s websites, or otherwise use the company’s products and services. At its core, a Privacy Policy is a company’s notice that tells a consumer its data practices: what personal information the company is collecting from the user, why it’s doing that, how it’s using the data, and who else it’s giving the data to. For consumer apps, privacy policies are especially important given that the entire company is built around and upon the collection, processing, and use of user information.
The law requires all applicable companies to maintain a Privacy Policy. For example, California affirmatively requires a posted privacy policy under CalOPPA, California Business & Professions Code § 22575: “Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.”
Ultimately, a Privacy Policy is a notice for consumers, required compliance for applicable laws, as well as a legal shield against lawsuits and other consumer disputes (albeit poorly drafted or outdated privacy policies will cut the other way as well).
How can I draft a good Privacy Policy?
Suffice it to say, drafting a Privacy Policy is difficult because, to draft a notice of the company’s data practices, the drafter needs to understand those practices, which requires an understanding of the actual product/services being offered and how data is being used to further the business.
To draft a good Privacy Policy, you need to understand the company and the product offering at a high level. Practically speaking, you will want to do an intake of the company’s existing data practices. This means speaking with both business as well as technical leads. To save time and/or reduce legal fees, make sure that this stays a collaborative process. Review the company’s existing data practices and any other relevant policy documents and see what existing documents say.
When you meet with cross-functional teams, confirm what practices still exist and ask whether things have changed. For example, have they changed any third-party vendors? What information is now or no longer required? What’s optional? What information is collected automatically? How are new business or growth strategies changing how data is being shared with third parties?
In addressing the key questions – what data is being collected, what it’s being used for, and who it’s being shared with – a complete Privacy Policy will also address the related questions. These are questions like the source of the collected data, how long data is retained, how the data is protected, what choices a user has in terms of what data is shared, and statutory notices required by specific state laws about what any consumer’s rights are or what other rights might possibly apply in the applicable jurisdiction. The key questions serve as a useful starting point, as they force companies to understand, at a fundamental level, what is being done with the user information.
To keep things practical and focused (as opposed to vague), this practical note will use the concrete example of a consumer dating app.
What information does the product collect?
“Personal information” or “personal data” is much broader than a user’s name, email address, or phone number. For a consumer dating app, it would include other account and profile information, photos, and things like messages being exchanged between users, as well as information relating to a consumer’s interactions with the company such as ticketing, reports, and support. Importantly, not all of this information is something a user knowingly types into a form. There’s automatically collected information like device identifiers, IP addresses, usage information. There might also be information obtained from third parties. There could also be financial information relating to paid subscriptions.
Some information also qualifies as sensitive personal information or sensitive data. Depending on the jurisdiction, that may include categories such as precise geolocation, biometric information, health information, racial or ethnic origin, sexual orientation, or information about a person’s sex life. (Note: In September 2026, Grindr settled a UK lawsuit alleging that it shared sensitive user data, including HIV status, with advertising companies. Grindr settled for £26 million, admitting no liability)
A purpose of a Privacy Policy is to help make visible all of a company’s data practices. If we take Hinge as an example, it’s obvious to a user that the dating app company has its email address if the user types it in. It’s also obvious for any other information that users provide directly, including profile photos, purchases, and even things like geolocation data since that’s how users are matched. But as for what a software development kit (SDK) collects in the background or what information reaches Hinge through some other service – now, that’s much less obvious and perhaps for many users even unexpected.
Why does the company collect the data, and what does it do with it?
Identifying the collected information is only the beginning. The next question is why the company has it and what is being done to the data.
Privacy lawyers often use the word “processing” to describe what happens to personal information. It is a broad term that can include various synonyms like collecting, storing, using, analyzing, disclosing, modifying, and/or deleting data. Basically, it refers to actions that may be done to the data in order for the data to be useful.
Again, dating apps makes the idea intuitive. Information about a user’s profile, preferences, and interactions with the service can be used to operationalize a user’s dating experience in recommending potential matches. As of its Privacy Policy update in late 2024, Grindr is now also using artificial intelligence, labeling it “gAI” for various purposes, including, user personalization, platform safeguarding, and model training. To function, dating companies need to make money, whether through premium subscriptions, advertising, or other monetization strategies involving what consumers often describe as the “selling” of their personal data.
(Meta/Facebook, perhaps, comes first to mind. Cambridge Analytica, anyone? Also, what are folk’s thoughts on the Muse personal agent released in September 2026?)
Who else receives the information?
A Privacy Policy needs to explain where else the personal information goes. Sometimes the answer is obvious from the product. If you match with another user on Hinge, then that person obviously has access to your profile as well as any message you decide to send your match. But the data also goes to vendors, providers, and third parties.
These other disclosures happen behind the scenes. A company may use a cloud provider to host information, a payment processor to handle purchases, an analytics provider to understand how the product performs, or a customer support platform to handle support requests. For example, Hinge discusses disclosures to other members, service providers and partners, advertising partners, affiliates, law enforcement in appropriate circumstances, and parties involved in certain corporate transactions. Both the legal and technical terminology can get complicated. Depending on the law, terms such as “service provider,” “processor,” “third party,” “sale,” and “sharing” may further have particular definitions.
Don’t forget though. The ultimate goal is really just to (strategically) answer the question for the user: Who else gets my information, and why? A company should understand the information that internally moves through its own product. If you’re able to understand that information flow, then you should be able to draft a compliant Privacy Policy (assuming you understand the applicable laws). Perhaps, though, more than mere compliance or increased trust and transparency with users, the greater purpose of a Privacy Policy is to act as a strategic shield against potential lawsuits.
As the public facing expression of the company’s data map and practices, a Privacy Policy should be understandable by the user. Under CCPA, 11 C.C.R. § 7003(a), “Disclosures and communications to consumers shall be easy to read and understandable to consumers.” Accordingly, if you understand how the technology works and can explain relevant provisions to a user (who has zero technical or legal background), your Privacy Policy should be in good shape.
Remember: Your Privacy Policy serves as legal notice to the user, not as blanket permission from the user to act
Incorrectly, Privacy Policies are sometimes treated as documents that users simply “agree to.” But this is not quite the right way to think about them.
There is an important distinction between a Privacy Policy and the Terms of Service. A Privacy Policy is a notice. Its job is to explain what happens to personal information. In contrast, the Terms of Service (or Terms of Use) perform the separate function of establishing the contractual relationship between the company and the user.
Consent can still matter a great deal in privacy law. Depending on the information and proposed use, a company may need a user’s consent before engaging in particular processing. But putting a sentence in a Privacy Policy does not necessarily obtain that user consent. Instead, the relevant choice might instead happen through an operating system permission, a cookie preference interface, a setting inside the app, or a separate disclosure shown when a feature is activated. For example, a user might click an “I agree” or “I understand” prompt inside the app or receive a particular prompt triggered by a specific user action.
In sum, there can be two different questions. The basic question is: Did you tell the user what you do? Versus, where required by law, the second: Did the user actually consent to you doing it?
They may overlap. They may not. It depends on the particular law, which is something that you will need to research based on the particular data practice or product feature. This is also why publishing a Privacy Policy does not mean a company has “done privacy.”
An important corollary: Update the product or data practice accordingly
In other words, sometimes the appropriate result or related consequence of the privacy analysis is that sometimes the legal fix is not to change the Privacy Policy, but to change the product or privacy practice itself. A company may also need user controls, consent mechanisms, security practices, retention rules, internal access controls, procedures for responding to privacy requests, or shorter notices presented at the moment information is collected or used. Remember too that a Privacy Policy is a single but admittedly an important component of a broader set of technical and legal privacy controls.
My Biggest Takeaway – Justin Sha
As I was working on a Privacy Policy for a consumer social application that is currently live and running on the Apple App Store and Google Play Store, I suppose my biggest takeaway would be this: You Cannot Draft A Good Privacy Policy Without Understanding the Product.
For example, questions that initially looked like legal drafting questions kept turning into factual questions:
- If a user purchases a subscription, does the company itself receive the payment credentials, or does Apple, Google, or another payment processor handle them?
- If the app uses an analytics SDK, what does that SDK actually collect, and where does that information go?
- If a user deletes their account, what information is actually deleted, what is retained, for how long, and why?
- If one user reports another, what information from the account or conversation becomes available to the company for review, and how long is that information retained?
- If the product uses an outside service for age verification or another sensitive function, what does that provider send back to the company: the underlying information, or only a verification result?
- What information can company administrators access, under what circumstances, and through which systems?
- Which vendors receive user information, what categories do they receive, and what are they permitted to do with it?
- If the product uses location or another device permission, what information is actually collected, when is it collected, and what changes when the user turns that permission off?
- What information is generated from a user’s activity, rather than directly provided by the user?
You cannot answer these questions by doing more legal research or drafting better user-facing prose. Someone has to figure out how the product actually works.
For a mobile application, that investigation can get surprisingly technical. Apps can incorporate third party code for analytics, authentication, payments, customer support, security, advertising, and other functions, and these tools can cause information to move between systems in ways that are not apparent from a mere look at the application’s interface.
Depending on the company, answering those questions may require talking to product, engineering, customer support, payments, marketing, and whoever manages outside vendors. It may require looking at vendor documentation or contracts. In addition, sometimes the company’s assumption about what the company thinks its own feature does needs to be checked against what the feature actually does in practice.
In that sense, drafting a Privacy Policy can function as a lightweight internal privacy audit.
Use Competitor Privacy Policies as Checklists, Not Templates. Looking at another company’s Privacy Policy can also be useful for issue spotting, but it should not substitute for understanding your own product. A competitor’s policy may identify questions you should ask about advertising, AI, SDKs, retention, sensitive information, or international transfers. But another company’s answers are not necessarily yours.
A final point: Say what you do, and do what you say
There can always be a temptation to draft the Privacy Policy as broadly as possible, especially if the business or technical teams are not yet sure if they will adopt a different feature or data practice in the future. But a Privacy Policy should meaningfully describe the company’s current privacy, data, and information practices.
Overbreadth can make the document less useful and make the product appear more invasive than it actually is. More importantly, once a company tells users what it does with their information, its actual practices should match those representations.
For a mobile app, that consistency also extends beyond the Privacy Policy. The company may also make privacy representations through Apple App Store disclosures, Google Play disclosures, onboarding screens, device permission requests, settings, consent interfaces, and other notices.
Ultimately, start with the product, understand the law, and investigate or research both until your questions are answered, and in so doing and undertaking the drafting of your Privacy Policy in this structured but flexible and adaptive approach, you should come out with a great Privacy Policy that is not only compliant or specific to your features, but also one that is easy to understand, both building consumer trust and serving as a buttress against potential consumer disputes down the road.
