Does Your Contractor Website Need a Privacy Policy? We Checked 1,625 Sites and 42% Don't Link One.

If your website has a quote form, it collects a name, a phone number and an email address. If it runs Google Analytics or Meta's pixel (the Facebook pixel), it also sends visitor data to Google or Meta. Both companies make you promise, in the terms you accepted when the tag went on your site, that your site tells visitors about it. California and Quebec have their own rules on top of that.

So does a contractor website need a privacy policy? If it runs Google Analytics or a Meta Pixel, those tools' own terms say yes, and they say the policy has to name them. If it collects names, emails or phone numbers from California homeowners, California law says yes. In Quebec, the law says a business that collects personal information through technological means must publish one on its website. We aren't lawyers, and this isn't legal advice. It's what the documents say, quoted word for word below.

On October 19, 2026 we opened 1,625 contractor websites to see how many actually do it. 688 of them (42.3 percent) have no privacy policy link on the home page at all. And of the 1,138 that run Google Analytics or a Meta Pixel, only 159 (14.0 percent) link a policy that names the tools they run.

How We Checked 1,625 Contractor Websites, and What We Couldn't See

We ran 96 Google Places searches: six trades (roofing contractor, HVAC company, plumber, electrician, general contractor and landscaping company) in 16 metros. Eight are in the US (Los Angeles, San Diego, Sacramento, Phoenix, Dallas, Atlanta, Denver and Chicago) and eight in Canada (Toronto, Vancouver, Calgary, Ottawa, Winnipeg, Halifax, Montreal and Quebec City). We took the top 20 for each, service-area businesses that hide their address included. After dropping Facebook pages and directory listings, that left 1,754 business websites.

We opened every home page in a real Chrome browser, let it load, moved the mouse and scrolled (some sites hold their tracking until you do), and logged every request the page sent. If the home page had a link with “privacy” in it, or “confidentialité,” “vie privée” or “renseignements personnels” on French sites, we opened that page and read it. 129 sites wouldn't load, blocked us or were parked. That leaves 1,625 readable sites, 797 in the US and 828 in Canada.

Know the limits before you read the results:

• One visit, one day, from a Canadian internet connection. A cookie banner that holds tags until you click Accept hides those tags from us, so our tag counts are a floor.
• We read the home page and the one page its privacy link opens. If a site keeps its list of tools on a separate cookie page, or posts its policy as a PDF, we didn't read it.
• “Names the tool” is a text check. It can't tell you whether a policy is legally good enough. Only a lawyer can do that for your business.
• These are Google's top 20 results for each search, not a random sample of every contractor. Big, busy companies show up more often than they would in a phone book.
• We haven't named any business. Every number below is a total.

4 in 10 Contractor Websites Have No Privacy Policy Link

688 of the 1,625 sites (42.3 percent) have no link to a privacy policy anywhere on the home page, header and footer included. Another 17 show the words “Privacy Policy” in the footer with no working link behind them. 920 (56.6 percent) link one.

We hand-checked 40 sites picked at random from the no-link group. All 40 really had no privacy link. 41 of the 688 do link a terms, legal or disclaimer page that might hold privacy wording. We didn't count those as a policy.

Group	Readable sites	No privacy policy link
All sites	1,625	688 (42.3%)
Fewer than 50 Google reviews	320	187 (58.4%)
50 to 199 reviews	677	340 (50.2%)
200 to 999 reviews	465	151 (32.5%)
1,000 or more reviews	163	10 (6.1%)
HVAC	285	65 (22.8%)
Plumbing	258	84 (32.6%)
Roofing	283	100 (35.3%)
General contractors	287	142 (49.5%)
Landscaping	292	159 (54.5%)
Electrical	265	149 (56.2%)

The biggest gap is size. Businesses with fewer than 50 Google reviews skip the link 58.4 percent of the time. With 1,000 or more reviews it's 6.1 percent. That's a correlation, not a ranking tip. Bigger companies tend to pay for bigger websites, and a privacy page usually comes with them. By trade, HVAC companies are the most likely to have one and electricians and landscapers the least.

Site builder or place	Readable sites	No privacy policy link
WordPress	913	341 (37.3%)
Duda	58	21 (36.2%)
Webflow	41	15 (36.6%)
Custom or other	348	151 (43.4%)
Wix	122	68 (55.7%)
GoDaddy	79	49 (62.0%)
Squarespace	51	37 (72.5%)
US sites	797	288 (36.1%)
California metros	297	103 (34.7%)
Other US metros	500	185 (37.0%)
Canadian sites	828	400 (48.3%)
Quebec metros	201	79 (39.3%)
Rest of Canada	627	321 (51.2%)

The site builder lines up with it too. 72.5 percent of Squarespace sites, 62.0 percent of GoDaddy sites and 55.7 percent of Wix sites have no privacy link, against 37.3 percent on WordPress. We didn't test what each builder sets up by default, so read that as who uses which builder, not a verdict on the builder. (We spotted the builder from each page's code. The small ones are left out of the table.)

Place barely moves it. California, where a 2004 law asks commercial sites to post a privacy policy conspicuously, sits at 34.7 percent against 37.0 percent for the other US metros. Quebec, whose privacy law names websites directly, does better than the rest of Canada: 39.3 percent against 51.2 percent.

7 in 10 of These Sites Send Visitor Data to Google, Meta or a Recording Tool

1,199 of the 1,625 sites (73.8 percent) fired at least one analytics, advertising or session-recording tool while we watched. Most owners never see this list:

• Google Analytics: 1,106 (68.1%). 126 of them still load the old Universal Analytics code, which Google says Google Analytics 4 “has replaced”.
• Google Ads tag: 689 (42.4%).
• Meta Pixel: 402 (24.7%).
• Session recording: 295 (18.2%). These tools, like Microsoft Clarity (223 sites) and Hotjar (49), record clicks and scrolling so the owner can replay a visit.
• Also seen: the Microsoft Ads tag on 103 sites and CallRail call tracking on 171.

And 952 home pages (58.6 percent) have a form that asks for a name, email or phone number. California's law counts all three as personal information.

Sites with tracking are more likely to link a policy than sites without it. 36.2 percent of tracking sites have no privacy link, against 59.6 percent of sites that run no tracking at all. More likely still leaves 434 sites sending visitor data to Google, Meta or Microsoft with no privacy link on the page.

What Google's and Meta's Own Terms Say You Have to Post

Google's Analytics terms of service, last updated May 15, 2023, say you “must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies” and similar technology used to collect data. The next sentence: “You must disclose the use of Google Analytics, and how it collects and processes data.” Google adds that a prominent link to its page called “How Google uses information from sites or apps that use our services” can do the disclosing part.

Meta's Business Tools Terms, in effect since November 3, 2025, go further. By using the pixel, you “represent and warrant” that each page where it runs has “a clear and prominent notice” linking to an explanation of three things:

• “that you may use pixels, web beacons, and other storage technologies from third parties, including Meta, to collect or receive information from your websites”
• “how users can opt-out of the collection and use of information for ad targeting”
• “where a user can access a mechanism for exercising such choice”

Meta's own examples for that last part are links to aboutads.info and youronlinechoices.eu.

Put plainly: if you run Meta's pixel, Meta expects your policy to name Meta, explain the ad targeting and tell people how to opt out. If you run Google Analytics, Google expects your policy to say so.

We couldn't find either company publishing how often it enforces these terms against small advertisers, and we won't guess. What we can say is that the promise sits in the terms that came with the tag, whoever installed it.

Having a Policy Isn't Enough: Only 14% of Tracking Sites Name Their Tools

920 sites link a privacy policy. Behind those links we found 816 readable policies. The rest: 40 pages that are close to empty (one says only that its policy is coming soon), 15 PDF or Word downloads we didn't read, 14 links to the website company's or directory's own policy instead of the business's, 14 that blocked our reader, and 21 that led to a page that isn't a policy.

Then we read the 816 real ones against what each site runs:

• Google Analytics: 202 of the 647 readable policies on Google Analytics sites (31.2 percent) name it. Another 100 say “analytics” without naming Google. Google's terms ask for Google Analytics by name.
• Meta Pixel: 64 of 299 (21.4 percent) name Meta or Facebook.
• Ad opt-out: on sites running any ad pixel, 94 of 507 policies (18.5 percent) tell visitors how to opt out of ad targeting or point to a page that does.
• Session recording: 17 of 212 (8.0 percent) mention recording, heatmaps, Clarity or Hotjar.
• A date: 58.2 percent show an effective or last-updated date. California's law asks for one.
• Leftover template text: 12 still have filler like a bracketed company name or lorem ipsum.

Now put the two biggest tools together. 1,138 sites run Google Analytics, a Meta Pixel or both. Only 159 (14.0 percent) link a readable policy that names every one of the two they run. Of the other 979, 402 have no privacy link, 7 have a dead one, 63 link a page we couldn't read as a policy and 507 have a real policy that leaves at least one of the two out.

Meta's pixel is the starkest. 402 sites run it. 64 (15.9 percent) have a readable policy that names Meta, and 28 (7.0 percent) also tell visitors how to opt out.

One counterpoint. A long policy isn't automatically a good one. A short page that honestly lists the tools your site runs, what they collect and how to opt out tells a homeowner more than 3,000 words that name none of them.

What the Law Says in California, Quebec and the Rest of Canada

California. The California Online Privacy Protection Act has applied since July 1, 2004. It says an operator of a commercial website “that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site.” The law's list of personally identifiable information includes “A first and last name.”, “An e-mail address.” and “A telephone number.” That's your quote form.

The policy has to “Identify its effective date.” and say how the site responds to Do Not Track browser signals if it tracks visitors across other sites. One way to post it conspicuously is a home page text link that “Includes the word "privacy."” Two details matter. The law only counts it as a violation if a business fails to post its policy “within 30 days after being notified of noncompliance.” And the duty sits with the owner, not the web designer: the operator “does not include any third party that operates, hosts, or manages, but does not own, a Web site or online service on the owner's behalf.” Of the 172 readable policies on California-metro sites, 62.8 percent show a date and 18.6 percent mention Do Not Track.

Quebec. Section 8.2 of Quebec's private-sector privacy act says: “Any person who collects personal information through technological means must publish on the enterprise's website, if applicable, a confidentiality policy drafted in clear and simple language and disseminate it by any appropriate means to reach the persons concerned.” Section 8.1 adds that anyone using technology that can identify, locate or profile a person “must first inform the person” of that technology and of the means available to activate those functions. 39.3 percent of the Quebec-metro sites we checked have no privacy link.

The rest of Canada. Canada's federal privacy law, PIPEDA, doesn't use the word website. Its openness principle says: “An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.” It also says people “shall be able to acquire information about an organization's policies and practices without unreasonable effort.” For a business whose customers find it online, the website is the obvious place to do that. Outside Quebec, 51.2 percent of the Canadian sites we checked have no privacy link.

A 20-Minute Privacy Policy Check for Your Website

1. Find out what your site runs. Open your home page in Chrome, right-click, choose Inspect, open the Network tab and reload. Type “collect,” “fbevents” or “clarity” in the filter box and see what shows up. Or ask whoever built your site for a list of every tag on it, including anything inside Google Tag Manager.
2. Put a link with the word “privacy” in your footer. On every page, not just one. A home page link with the word privacy is one of the ways California's law lists for posting a policy, and it's where people look.
3. Name every tool. Google Analytics, Google Ads, Meta's pixel, Clarity or Hotjar, call tracking. Say what each one collects, such as pages viewed, device type and anything typed into your forms, and who receives it.
4. Give the opt-out. Meta's terms ask for it. Point people to aboutads.info/choices (Meta's own example) and explain how to block cookies in their browser.
5. Say what happens to form details. Who reads a quote request, whether you'll call, text or email, and how someone can ask you to delete their details.
6. Add an effective date. Change it whenever you add or remove a tool.
7. Search your own policy for “[” and “Company Name.” Generators leave placeholders, and 12 of the policies we read still had them.
8. Make sure you own the accounts the tags report to. A pixel installed under someone else's ad account is a privacy problem and an ownership problem. Our post on who owns your marketing accounts covers how to check.

A privacy page is one of the small trust details a homeowner checks before handing over a phone number, along with your license number. Our post on license numbers on contractor websites covers that one. Rebuilding anyway? See our website design and Google Ads pages, or book the free call and we'll go through your Network tab with you.

How we did this: On October 19, 2026, from about 3:05 to 3:30 p.m. Pacific, we ran 96 Google Places API text searches (6 trades in 16 US and Canadian metros, top 20 each, service-area businesses included) and opened 1,754 business websites in a headless Chrome browser. We logged every network request during load plus a mouse move and scroll, read every link on the home page, and opened the first privacy link we found. Sites that errored, blocked us, returned an error code or were parked were left out, leaving 1,625. A policy “names” Google Analytics if its text says Google Analytics (or Google next to analytics, or links Google's how-we-use-data page), and “names” Meta if a full sentence or a listed item says Meta or Facebook. Menu and social links were filtered out first. We have not named any business.

Frequently Asked Questions