Privacy Policy for AdSense: What to Include

AdSense has a Privacy Policy requirement for one main reason: ads are served via cookies, those cookies process personal data, and someone somewhere has to disclose what’s happening. That someone is you, the publisher.

Most publishers paste a generic template and call it done. Generic templates fail one of two ways: they describe data practices the site doesn’t actually do, or they omit the parts AdSense reviewers actively look for. The sections below cover what belongs in the policy and why.

What AdSense reviewers look for, specifically

Reviewers don’t read your whole policy. They scan for a small set of phrases:

• That third-party vendors, including Google, use cookies to serve ads.
• That Google’s use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and other sites on the internet.
• That users may opt out of personalised advertising by visiting Google’s Ads Settings page.
• A link to Google’s ad-technology policy page or equivalent reference.

These are the AdSense-specific bits. The rest of the policy needs to cover the broader compliance situation, particularly if you have users in the EU, UK, or California.

Required sections

The structure that satisfies most jurisdictions plus AdSense:

1. Who you are. The publisher’s name and a contact method.
2. What information you collect. Distinguish between information visitors actively give you (contact form, comments, newsletter signup) and information collected passively (analytics, ad-targeting cookies, server logs).
3. Why you collect it. Plain language is fine. “To deliver the website, to serve advertising, to respond to messages.”
4. Cookies and similar technologies. What you set, what third parties set on your behalf, how to disable them.
5. Third-party services. AdSense, Google Analytics, any other vendor with code on your site. Link to each vendor’s policy.
6. Legal bases (for GDPR). Usually consent for ad targeting, legitimate interest for analytics, contract for transactional emails.
7. User rights. Access, deletion, correction, objection, and portability, at least under GDPR/UK GDPR, plus the CCPA equivalents (right to know, right to delete, right to opt out of sale).
8. Children’s privacy. Confirm the site isn’t directed at children under 13 (or 16, depending on jurisdiction), and how to handle accidental child data.
9. Changes to the policy. How you’ll communicate changes.
10. Contact details. Email, postal address, or both. If you’re EU-facing, a Data Protection Officer contact (or a clear statement that one isn’t required).

The personalised ads disclosure

This is the AdSense-specific paragraph. Adapt the wording but keep the substance:

Third-party vendors, including Google, use cookies to serve ads based on a user’s previous visits to this and other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on these visits. Users may opt out of personalised advertising by visiting Google’s Ads Settings. You can also opt out of a third-party vendor’s use of cookies for personalised advertising by visiting www.aboutads.info.

Reviewers can find that paragraph by searching for “personalised advertising” or “Google’s Ads Settings.” Including those exact phrases is what makes the policy machine-readable as well as human-readable.

GDPR and CCPA specifics

If you have any users in the EU or UK, GDPR and UK GDPR apply regardless of where you’re based. The thresholds and requirements:

• You need a lawful basis for processing each category of data. For advertising cookies, that’s consent — which means a real cookie banner with reject and accept options, not a pre-ticked box.
• Users must be able to exercise their rights through a clear contact channel. An email address in the policy is the minimum.
• For larger sites, a Data Protection Officer may be required. Most small publishers don’t cross the threshold, but mention the policy on it explicitly.

For California users, CCPA requires a “Do Not Sell My Personal Information” mechanism if you sell data, plus disclosures of categories collected and shared. Most publishers don’t sell data in the technical sense. But the rules around “sharing” for cross-context behavioural advertising have tightened. If your AdSense units run personalised ads, that’s arguably sharing under the revised CCPA. Disclose accordingly.

Where to put the link

The Privacy Policy link must be visible on every page. Convention is the footer, in plain text, with the words “Privacy Policy.” It shouldn’t sit behind an icon or inside a hamburger that needs a click to open. Reviewers expect it in the footer; putting it elsewhere is a mild risk.

Don’t bury it inside an about page or a generic “Legal” index. Use a direct link in the footer of every page.

Common mistakes

• Copy-pasting a template that mentions services you don’t use. A policy that promises “you can manage your account settings here” on a site that has no accounts is a fast tell.
• Listing “we may use” for everything. Reviewers want to know what you do, not what you reserve the right to do someday.
• Forgetting to update the policy after adding a tool. You added Mailchimp last month. The policy should mention Mailchimp.
• No date. Show the “last updated” date at the top. Reviewers expect it, and so do users.

The fastest way to do this right

Start with our Privacy Policy on this site as a reference structure. Adapt the sections to match what your own site actually does, including or removing third-party services as appropriate. Run it past a friend who’s never seen the site. If they can’t tell what you collect and why, rewrite. Then put the link in the footer of every page and forget about it until something material on your site changes.