Privacy policy generators that cover CCPA and GDPR
For a small business writing its first privacy policy, or replacing one it pasted in years ago. 6 generators, free plans and paid, measured on whether the policy carries the GDPR Art. 13 items, the CCPA privacy policy items and the other state laws, and whether it changes when the law does, from each vendor’s own pages. read 2026-10-22
Best for one policy that covers the EU and the US
iubenda
One setting adds the US state sections to its GDPR policy, and its pricing page says every plan updates the text when laws change.
Best for a one-site shop starting free
CookieHub
No account, GDPR and CCPA rights sections and retention wording; you host it and you keep it current yourself.
Best for a US firm tracking the state laws
Termly
Its own pages name 16 state laws beyond California, with hosted policies that update in place on Pro+.
The requirements, generator by generator
The first three rows are the notice lists of the GDPR, California and the Virginia-style state laws. The next two are about keeping the policy right after you publish it. Read down a column for one generator. Once you have a draft, our privacy policy checklist checks it item by item.
| Requirement | Termly | iubenda | CookieYes | CookieHub | Usercentrics | GetTerms |
|---|---|---|---|---|---|---|
| Covers the GDPR notice itemsGDPR Art. 13(1)–(2) | yes | yesfree plan: no retention input | yes | yesretention and controller role | yes | paid planfree: a basic policy |
| Covers the CCPA privacy policy itemsCiv. Code § 1798.130(a)(5); regs § 7011(e) | yes | yesone US toggle | paid planPro and up | yes | paid planfree plan wording differs | paid plan |
| Covers the other US state lawse.g. Va. Code § 59.1-578(C) | paid plan16 more state laws | yesthe states it supports | not stated | partial“various US states”, unnamed | paid plan | not stated |
| Updates the text when the law changes§ 1798.130(a)(5): update at least every 12 months | paid planauto-updates on Pro+ | yes | not stateddates update; law text not said | nostatic template | yesplan not stated | paid planmonitoring on Business |
| Publishes a hosted or live-embedded policyregs § 7011(c)–(d): posted online, printable | paid planfree: static HTML | yes“self-updating” policy | paid planhosted URL on Basic | notext or HTML only | not stated | yes |
| Writes the cookie disclosuresePrivacy Art. 5(3): “clear and comprehensive information” | yes | yes | yes | yessections inside the policy | not stated | paid plan |
| Writes the policy in the reader’s languageGDPR Art. 12(1): intelligible form | paid planPro+ | paid planone language on Essentials | paid planBasic and up | not stated | paid planfree: English | paid plan7 languages on Business |
| Makes a usable policy on a free planno rule: the question most readers start with | yesone basic policy | yesup to 3 services | yesno CCPA policy on free | yesno sign-up | yesone policy | yesbasic, personal sites |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||||
What the policy has to say, law by law
“Covers the GDPR and the CCPA” is on every generator’s page. The two laws ask for different things, and the states that followed Virginia ask for a third set. Here is where each law asks for each item. Read across a row to see which law is the reason a sentence is in your policy.
| The policy says | GDPR | California | Virginia |
|---|---|---|---|
| Who you are and how to reach you | Art. 13(1)(a) | § 7011(e)(3)(J) | not on its list |
| The categories of personal data | Art. 14(1)(d), data not collected from the person | § 7011(e)(1)(A) | § 59.1-578(C)(1) |
| Why you use it | Art. 13(1)(c) | § 7011(e)(1)(C) | § 59.1-578(C)(2) |
| The legal basis for each purpose | Art. 13(1)(c) | not on its list | not on its list |
| Who receives it | Art. 13(1)(e) | § 7011(e)(1)(E), (H) | § 59.1-578(C)(4)–(5) |
| Transfers outside the EU | Art. 13(1)(f) | not on its list | not on its list |
| How long you keep it | Art. 13(2)(a) | not on its list | not on its list |
| Whether you sell or share it | not on its list | § 7011(e)(1)(D) | § 59.1-578(D) |
| The reader’s rights | Art. 13(2)(b)–(d) | § 7011(e)(2) | § 59.1-578(C)(3) |
| How to make a request | not on its list | two or more methods, § 1798.130(a)(5)(A) | § 59.1-578(E) |
| How to appeal a refusal | not on its list | not on its list | § 59.1-578(C)(3) |
| How opt-out signals are handled | not on its list | § 7011(e)(3)(F) | not on its list |
| The date it was last updated | not on its list | § 7011(e)(4) | not on its list |
Source: Regulation (EU) 2016/679, the CCPA statute and regulations (cppa.ca.gov) and the Code of Virginia, read 2026-10-22. Lists only; each law has more detail. | |||
Three rows trip up a policy written for only one side. The GDPR wants the legal basis, the transfers abroad and the retention period; a California-only policy usually leaves them out. California wants the sale-or-share statement, the opt-out signal paragraph and the last-updated date; an EU template rarely has them. Virginia adds the appeal: how a reader challenges your answer to their request. Our GDPR and CCPA side by side explains the rest of the split.
The 12-month clock
A generated policy does not stay right by itself. The California statute puts a clock on it:
“Disclose the following information in its online privacy policy or policies … and update that information at least once every 12 months”
That is why the table has a row for law updates and one for hosted policies. A policy you pasted in as HTML changes only when you paste it again. A hosted or live-embedded one can change in place, though only if the vendor actually updates it on your plan. The text of the CCPA regulations effective 1 January 2026 also lists, for a business that uses automated decision-making technology, the rights that go with it (§ 7011(e)(2)(F)–(G)): one reason a policy generated earlier deserves a fresh read.
What no generator knows about you
A generator writes from your answers. It cannot see which scripts your site loads, what your contact form stores, or which vendors get the data. Under the GDPR the information goes to the reader “at the time when personal data are obtained” (Art. 13(1)), and Virginia wants the categories of data the controller actually processes (§ 59.1-578(C)). An answer you guessed becomes a sentence that is wrong.
Write down what you collect, where it goes and how long you keep it. Our data map template is built for exactly that. Then check whether the California law reaches you at all with the CCPA threshold calculator. If it does, the policy is not the only notice you owe: the notice at collection sits where the data is taken, and our template for it is under Related.
Each generator in short
What each one is, who it fits, what it covers, and what to ask before you publish. Every vendor here also sells a consent banner, so the policy and the banner can live in one account. If the banner is the bigger decision, start with our consent management platforms compare.
Termly
What it is
A policy generator and consent platform under one account. Its own pages say its products cover 28 privacy laws, among them the GDPR, the CCPA and 16 other US state laws.
Who it fits
A US firm that wants the state laws tracked for it, and is ready to move off the free plan once the policy matters.
What the rule requires and whether it meets it
The free plan gives one basic policy, published as static HTML. Paid plans add editing, broader law coverage and regulation updates; Pro+ adds hosted policies that change in place, auto-updates and other languages.
Check with the vendor
Which laws the free policy covers is not spelled out. If a free HTML policy is your plan, ask which sections it leaves out and how you will hear about a law change.
iubenda
What it is
A “self-updating” privacy and cookie policy built from a library its site puts at more than 2,400 clauses, one per service you use, sold beside its cookie banner.
Who it fits
A site with visitors in both the EU and the US that wants one policy to carry both, and the wording kept current for it.
What the rule requires and whether it meets it
EU GDPR is built in; one setting, “Enable disclosures for users residing in the United States”, adds the US state sections it supports. Its pricing page says every plan updates the text when laws change. Essentials writes in one language; Advanced and Ultimate in all.
Check with the vendor
Its free plan guide caps the free policy at three services, one language and no retention wording, and switches the free banner off past 5,000 pageviews a month. Which US states the toggle covers today is in its own guide; read it against our guide to the US state privacy laws.
CookieYes
What it is
A privacy and cookie policy generator that comes with the CookieYes consent banner, on a free plan and three paid ones.
Who it fits
A site already on (or choosing) the CookieYes banner that wants its policy in the same dashboard.
What the rule requires and whether it meets it
The free plan generates a privacy policy and a cookie policy, installed by snippet or HTML. A hosted policy URL and other languages start at Basic. The plan list puts the “CCPA-compliant privacy policy” at Pro.
Check with the vendor
Its “automatic policy updates” keep the effective and last-updated dates current as your answers change. The page does not say the text follows changes in the law, so ask.
CookieHub
What it is
A free generator from a consent platform vendor: three steps, no account, a policy you download as text or copy as HTML.
Who it fits
A small site that needs a first policy today and will own the upkeep itself.
What the rule requires and whether it meets it
Its page says the policy covers user rights for the GDPR, the CCPA and the LGPD, sets out how long data is kept and whether you act as controller or processor, and carries cookie sections inside it.
Check with the vendor
It says plainly that it does not host the policy and does not update it: the policy is a static template, and the law changes are yours to track. It names “various US states” without saying which.
Usercentrics
What it is
The privacy policy generator from Usercentrics, the consent platform vendor, sold as a Free and a Pro plan beside its banner.
Who it fits
An EU business that needs a GDPR policy in English, German, Italian or Dutch.
What the rule requires and whether it meets it
The plan table gives the free plan one policy, in English, on the GDPR; Pro adds the US state laws, the CCPA/CPRA and COPPA, unlimited policies and four languages. The product page promises updates when laws change.
Check with the vendor
The free plan’s own card calls its policy “GDPR- and CCPA-compliant”, while the table lists the GDPR alone. Ask which is right, and on which plan the law updates run.
GetTerms
What it is
A policy generator with a cookie banner, a free basic policy and paid Starter, Business and Partner plans.
Who it fits
An agency running client sites: the Partner plan adds policy templates, multi-user logins and client management.
What the rule requires and whether it meets it
The paid “Comprehensive” policy is built for the GDPR, UK GDPR, CCPA and PIPEDA. Policies can be hosted on its app, embedded live, pasted as HTML or downloaded as a PDF. Regulation monitoring and seven languages are on Business.
Check with the vendor
The free generator is described as a basic policy “without the cost of global compliance”. The pages do not name any US state law beyond California.
How we compared them
We started from the generators a small business finds when it searches for a free privacy policy generator: each has a free way in and a page that names the GDPR and the CCPA. We left out generators whose own pages we could not read on the read date, and plain templates that name no law. For the broader tools that also handle requests and records, see CCPA compliance software.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
On this page “paid plan” can also mean a vendor’s cheapest paid tier. Where the vendor names the plan, the note under the word says which.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Is a free privacy policy generator good enough?
It can be, for a site with simple data. The catch is upkeep, not the first draft: most free plans give you one policy as static HTML that never changes after you paste it, and some leave out the California sections. California asks for an update at least once every 12 months. If you stay on a free plan, put that review in your calendar and run the result through our privacy policy checklist, linked above.
Can one policy cover both the GDPR and the CCPA?
Yes. Most of the generators here write one policy with sections for each law. What matters is that every item on both lists is there: the GDPR’s legal bases, transfers and retention, and California’s categories, sale-or-share statement, request methods and last-updated date. The crosswalk above shows which is which.
Do I need a separate cookie policy?
The ePrivacy rule asks for clear and comprehensive information before cookies are set. Some generators put that in a section of the privacy policy, others in a separate cookie policy. Either works if it lists what your site actually sets. Our cookie policy template builds one from your cookie categories.
Does a generated policy make my site compliant?
No. A policy describes what you do; compliance depends on what you actually do. A policy that promises an opt-out your site does not honor creates a problem rather than solving one. If you are unsure which laws apply, start with our which-laws tool.
Why three picks instead of one winner?
Because the use cases differ. A one-site shop that needs a first policy today, a firm that wants the state laws tracked, and an agency running many sites each need a different plan shape. We compare the two directly on Termly vs iubenda.