ChatGPT Prompt for Privacy Policy: 12 Drafting Prompts

A ChatGPT prompt for privacy policy drafting works best when you feed it your real data practices: every form field, checkout step, newsletter signup, outside tool and cookie on your site. Ask for a data map first, then a plain-English policy built only from that map, with gaps flagged for you to answer. The 12 prompts below cover mapping your data, drafting each section, adding region and audience notices, and keeping the policy true after launch.

This page is drafting help, not legal advice. Privacy rules depend on where you and your customers are, so have a lawyer licensed where you operate review any policy before you post it.

The main prompt is the privacy policy prompt that drafts from your real data practices. Copy it, fill in the brackets, and use the shorter prompts below for each step.

What a privacy policy has to cover

A policy is a public description of what you do with personal information, so the facts come first and the wording second. A few rules shape what most small business policies include, checked against official sources on October 29, 2026:

• California's online privacy law (CalOPPA) asks a commercial website that collects personal information from California residents to post a policy listing the categories it collects, who it shares them with, how people can review changes if you offer that, how you announce policy changes, the effective date, and how you respond to Do Not Track signals if you track people across other sites.
• The CCPA, as amended by the CPRA, applies only to for-profit businesses that meet its size or data thresholds; if it covers you, the policy must explain consumer rights such as knowing, deleting and correcting data and opting out of its sale or sharing, and how to use them.
• The European Commission's GDPR guidance lists what people must be told when data is collected, including who you are, why you use the data, the legal basis, how long you keep it, who receives it, any transfer outside the EU, and their rights, including complaining to a data protection authority.
• The FTC's COPPA rule covers sites aimed at children under 13 and general sites that know they collect children's data, and it requires a policy describing those practices.

Whether each one reaches you is a question for your lawyer. The prompts below help you arrive with an accurate data map, which makes that conversation shorter.

Map your data first

1. Touchpoint inventory

List every place my business collects personal information. Here is what I know: [website pages, forms, checkout, signup tablet, app, social accounts]. Ask me about any common touchpoint I did not mention, one question at a time.

2. Field-by-field data map

Turn these touchpoints and fields into a table with columns for data collected, purpose, vendor that receives it, and how long we keep it: [touchpoints and fields]. Write ASK OWNER in any cell I did not answer.

3. Vendor list

These tools touch customer data: [tools]. For each, write one line saying what data it receives from us and what we use it for, based only on what I wrote. Mark anything I should check in the vendor's own settings.

Draft the policy

4. Full first draft

Using this data map: [paste map], draft a privacy policy for [business name and location] in plain English with sections for who we are, what we collect, how we use it, who receives it, cookies, retention, your choices, children, security, changes and contact. Describe only what the map shows.

5. Cookies and analytics section

Our site uses [analytics tools, pixels, embeds]. Write the cookies section of our privacy policy in under 150 words, naming each tool and what it is for, and say whether we use advertising cookies.

6. Requests section

People can reach us at [contact] to see, correct or delete their data, and we answer within [time]. Write the "Your choices" section, including how to unsubscribe from [email tool].

7. Plain-language rewrite

Rewrite this policy section so a customer can read it in one minute, keeping every fact: [section]. Use short sentences and the word "we".

Add region and audience notices

8. Law questions for counsel

We are based in [location], sell to [regions], have about [revenue and customer numbers], and [do or do not] aim anything at children. List which privacy laws I should ask my lawyer about and the one fact that decides each. Do not tell me whether they apply.

9. Notice at collection

Write a two-sentence notice to show next to this form before people submit it: [form fields and purpose]. Link to our privacy policy at [URL].

10. Do Not Track statement

Our site uses [tracking tools] and [does or does not] follow people across other sites. Draft a short statement on how we respond to browser Do Not Track signals, plus two questions to confirm with my developer.

Keep it accurate

11. Promise check

Compare this privacy policy draft: [draft] with this data map: [map]. Quote every sentence that promises more than the map shows, such as "we never share", and rewrite it to match.

12. Change log

We just added [new tool, form or region]. Tell me which sections of this policy need to change: [policy], draft the new wording, and suggest a new effective date line.

Worked example

A one-person online candle shop owner sketched their data flow in a notebook at the kitchen table: product page, checkout, a shipping label tool, a monthly email list, and an analytics script on the site. Prompt 2 turned the sketch into a five-row data map and flagged two gaps as ASK OWNER, how long order records stay in the store platform and whether the analytics tool keeps IP addresses. After the owner checked both settings, prompt 4 produced a 600-word draft with one section per row of the map.

Prompt 11 caught one line the chatbot added on its own, "we will never share your information", even though the shipping label tool receives every customer's name and address. The fixed line names the label tool and says why it gets the address. Prompt 8 then produced three questions for the owner's lawyer about shipping to other states, and the lawyer's notes went back into prompt 12 for the final version.

Variations

• App instead of website: list screens and device permissions as touchpoints, and ask for a section on what the app reads from the phone.
• Two brands, one company: run the data map once per site so each policy names only its own tools.
• Service business: swap checkout for intake forms and booking tools, and ask the prompt to treat appointment notes as their own row.

Practical tips

• Open each tool's settings while you fill in the data map. Retention and sharing defaults are often different from what you assume.
• Do not copy another company's policy. It describes their practices, not yours, and it may promise things you do not do.
• Keep the data map in the same folder as the policy and update both when you add a tool, a form or a new region.
• Ask your lawyer to review the final draft, especially any section about health, children or selling data.

More legal drafting prompts

Already have a policy? The privacy policy gap check prompt compares it with your practices, and the privacy policy FAQ prompt turns a finished policy into customer questions. For the rest of your site's legal pages, see the terms and conditions checklist prompt, the ChatGPT prompt for terms and conditions, the ChatGPT prompts for legal documents, and the ChatGPT prompts for small business owners.

See more in the Legal prompts hub, browse all prompts, or share a prompt you use.