Privacy policies are mandatory because you’re collecting data that can be used to identify an individual. Laws, including fed-eral and state laws in the US and various other countries, have provisions on data privacy.
Key points:
A privacy statement, documented and publicly posted for each digital property the organization operates where data is collected (including analytics)
A privacy policy detailing how the organization will manage and protect users’ personal data, documented and disseminated to those who create and manage digital properties on behalf of the organization
Read more:
Policy background, how is done: Immediate steps, Documenting and Implementing the policy: The Power of Digital Policy book, page: