Privacy Policy and Terms for a Website: What Your Business Must Publish

This post covers the two legal documents almost every Israeli business website needs: a privacy policy and terms of use. It is written for small business owners and independent service providers, such as coaches, therapists, consultants and private teachers, who have a site with a contact form and perhaps also sell a workshop, a course or a product.

What you will learn here:

• When a privacy policy is required, and what Israeli law says it must contain
• What changed with Amendment 13 to the Privacy Protection Law, and what it means for a small business
• When you need terms of use, and what they must include when you sell online
• How to handle cookies and a mailing list
• Why copying a document from another site is a mistake, plus a checklist of sections

One thing up front: this is general information, not legal advice. I hold a Data Protection Officer (DPO) certification and have been building websites for more than 10 years, but every business is different. Before you publish a legal document, have a lawyer review it.

A short glossary before we start

• Personal data: any data about a person who is identified or can be identified. Under the amended law this explicitly includes an online identifier and location data, not just a name and ID number.
• Privacy policy: the document that tells visitors what data the site collects, why, who it is passed to, and what rights they have.
• Terms of use: the contract between the business and whoever uses the site or buys through it. What is allowed, what things cost, how to cancel, who is responsible for what.
• Distance sale: a purchase where the customer and the business never meet, for example through a website, phone or WhatsApp. Israeli consumer law has special rules for it.
• Cookie: a small file the site stores in the browser, for example to remember preferences or to measure visits.

When is a privacy policy required?

The short answer: almost always, as soon as the site collects people’s details.

Section 11 of the Privacy Protection Law says that when you ask a person for personal data in order to store it in a database, the request must come with a notice. The notice has to say whether there is a legal duty to provide the data or whether it is voluntary, and what happens if the person declines. It has to state the purpose, who controls the database and how to reach them, who the data will be passed to and for what purpose, and that the person has the right to inspect the data and ask for corrections.

Now think about your own site. A “leave your details and I will call you back” form collects a name and phone number. A newsletter signup collects an email. Analytics tools like Google Analytics or the Facebook pixel collect online identifiers. A chat bot stores conversations. Each of these is collection of personal data.

An example: a yoga teacher from the Haifa Krayot with a three-page site and a sign-up form for a trial class. The form sends the details to her email and also to a Google Sheet. That is already collection, storage, and an outside vendor (Google) holding the data. A short privacy policy, linked right next to the submit button, covers exactly what Section 11 asks for.

What a privacy policy must contain

Beyond the items the law lists explicitly, a good policy includes a few more. Here is the list:

1. Who you are: the business name and a way to get in touch about privacy.
2. What is collected: what the visitor provides (forms, chat) and what is collected automatically (cookies, IP address, browsing data).
3. Why: to reply to an inquiry, deliver a service, send updates, measure the site. Each purpose separately.
4. Whether it is mandatory: and what happens if it is not provided. Without a phone number, for instance, you cannot be called back.
5. Who receives it: hosting, email, analytics, payment, and the chat bot vendor if there is one. By name or by type.
6. How long it is kept: and what happens afterwards.
7. How it is protected: in general terms, without promises you cannot keep.
8. The visitor’s rights: to inspect the data, ask for corrections, and unsubscribe from mailings. And how to actually do it.
9. Cookies: which tools run and how to refuse them.
10. Last updated date: a real date that changes only when the document changes.

Amendment 13: what changed, and what it means for a small business

Amendment 13 to the Privacy Protection Law took effect on August 14, 2025. It is the biggest update to the law in years, and it changed several things:

• The definitions were updated. “Personal data” now means data about a person who is identified or identifiable, including through an online identifier or location data.
• The Privacy Protection Authority got broader enforcement powers, including administrative fines.
• The duty to appoint a data protection officer applies to specific types of organizations: public bodies, data brokers with large databases, organizations whose core activity is large-scale systematic monitoring of people, and those processing sensitive data at scale (such as banks and health funds). Enforcement of that duty was postponed to October 31, 2025.

What does this mean for a cosmetician in Ra’anana with a site and a booking form? She most likely does not need to appoint a DPO. But the Section 11 duty to inform applies to her like anyone else, and the broad definition of personal data means her site analytics count too. The bottom line: a privacy policy written before 2025 and never updated is worth a second look.

When you need terms, and what they must say when you sell

Terms of use are the site’s contract. On a brochure site with no sales, they mainly define who owns the content, what responsibility you take for the information on the site, and which court handles disputes. The moment you sell through the site, even a workshop, a digital course or a product, the Consumer Protection Law comes into play and terms become a practical must. Payment processors also check them before approving card payments on a site.

Under Section 14C of the Consumer Protection Law, in a distance sale the business must disclose before the transaction, among other things:

• The business name, its ID or company number, and its address
• The main characteristics of the product or service
• The price and payment terms
• When and how it will be delivered
• Warranty details, if any
• The right to cancel and how to exercise it

The right to cancel, in brief: for goods, the customer can cancel within 14 days of receiving them or receiving the disclosure document, whichever is later. For services, 14 days from the transaction or from receiving the document. The cancellation fee is capped at 5% of the price or 100 shekels, whichever is lower. If the cancellation is due to a defect, late delivery or a mismatch with the description, no fee may be charged at all.

There are exceptions. Goods made specially for the customer, perishables and digital information are excluded from the cancellation right. People with disabilities, senior citizens aged 65 and over and new immigrants get a longer cancellation window of four months in certain circumstances. And one of the most important rules: a clause in your terms that narrows a right the law gives consumers does not hold.

One detail tends to surprise sole proprietors: for an individual, the business registration number is the national ID number. That is a real consideration before publishing it, so it is worth getting advice on the right way to meet the disclosure duty.

Cookies and a mailing list: what to do in practice

Cookies. Israel has no dedicated cookie law like the one in Europe. In February 2026 the Privacy Protection Authority published a final opinion on consent; according to summaries by law firms, it says continued use of a digital service after adequate information was shown may count as consent, but silence or lack of objection alone is not enough. My practical recommendation:

• A banner that briefly explains which tools load and why
• A refuse button exactly as prominent as the accept button
• A link at the bottom of every page to change the choice
• And if you have customers in the EU, explicit consent is required there before any analytics tool loads

Most important of all: the banner has to do what it says. A banner that promises “nothing loads without your approval” while analytics runs anyway is a false statement. Check it on your own site. If you measure your site, the post on simple website analytics also covers what is worth measuring.

Mailing list. Section 30A of the Communications Law, known to everyone as the “spam law”, prohibits sending advertising without the recipient’s prior consent, and lets recipients sue for compensation without proving damage. On a form, that means a separate, unchecked box for joining the mailing list. An order confirmation or an appointment reminder is a service message, not advertising, and it is worth spelling out that distinction in the policy.

Why copying another site’s policy is a mistake

This is the most common shortcut I see, and it sounds reasonable: why write from scratch when a document already exists? Here is the problem. A privacy policy is not generic text; it is a description of what your specific site does. A retail chain’s site describes shipping, a loyalty club and five advertising tools. Your site may send a form to WhatsApp and run one analytics tool.

Copying gives you three problems. The document makes untrue statements about your site. It leaves out what really happens on your site, such as a chat bot that stores conversations. And the text itself is copyrighted by whoever wrote it. A short, accurate document beats a long, impressive one that describes somebody else.

Common mistakes

• “Continued browsing constitutes consent,” and that is it. No explanation of what is collected and no way to refuse.
• Terms that say “no cancellations” on off-the-shelf goods. The law grants a cancellation right, and terms cannot take it away.
• A document that was never updated after a pixel, a bot or a shop was added.
• A “last updated” date that changes automatically every time the site is published, even when the document did not change.
• A contradiction between the terms and the site. “Shipping within 3 business days” in the terms and “up to two weeks” on the product page.
• Documents nobody can find. The link belongs at the bottom of every page and next to every form.

Checklist: which document, when, and what goes in it

I will not go into the accessibility statement here; there is a separate post on what Israeli accessibility law requires. And if you are about to launch, these documents are part of the launch checklist.

Before you publish, go through these questions:

• Does every form on the site appear in the policy, including where it sends data?
• Does every installed analytics and advertising tool actually appear in the list?
• Do the terms fit the kind of sale: off-the-shelf goods, made-to-order goods, an ongoing service or a one-time service?
• Are prices, delivery times and cancellation terms identical in the terms and on the sales pages?
• Is there a link to both documents at the bottom of every page?
• Has a lawyer reviewed the documents?

Summary

A privacy policy and terms of use are not decoration at the bottom of the site. A privacy policy answers the duty to inform in the Privacy Protection Law, which Amendment 13 broadened as of August 2025, and almost every site that collects details needs one. Terms become a practical requirement once you sell, and they must respect consumer rights such as disclosing the business details and the right to cancel. Both documents should describe your site as it really is, and be updated when it changes. And once more: this is general information, so have a lawyer review the documents before you publish.

Want a site whose legal documents are written for what it actually does, not copied? Let’s talk about your site ↗