A website that collects names, email addresses or phone numbers needs four things in place: a form that asks only for what the business uses, a privacy policy that matches what actually happens to submissions, a secure connection and sensible storage, and a plan for how long the information is kept. The Federal Trade Commission expects businesses to live up to the privacy promises they make. State privacy laws vary, so the specifics for your business are a question for counsel.
A contact form looks like a small feature. Behind it sits a chain of decisions: which fields to ask for, where each submission goes, who can read it, what other services touch it, and whether the address will later receive marketing email. Most of those decisions get made by default during a build unless someone makes them on purpose.
This is a planning guide for business owners and marketing leads, not legal advice. It covers what to decide and document so your counsel can review the policy against the rules that apply to you.
Start with what each form collects
The FTC's guide Protecting Personal Information sets out five principles for businesses: take stock, scale down, lock it, pitch it, and plan ahead. The first two apply before a single field is designed. Take stock means knowing what personal information you have. Scale down means keeping only what you need, and for sensitive identifying information the guide goes further: if there is no legitimate business need, do not collect it at all.
Apply that to every form on the new site. A quote request usually needs a name, a way to reply, and enough detail to respond. It rarely needs a date of birth, a home address before a site visit is booked, or a free-text box that invites people to paste account numbers. Each field you remove is one less thing to protect, store and explain.
A fictional example: the roofing estimate form
Consider a fictional roofing company in Georgia rebuilding its site. Its old estimate form asks for full name, date of birth, home address, phone, email, insurance carrier and policy number, and it sends every submission to the owner's personal email account. Nobody remembers why date of birth was added.
In the rebuild, the office manager walks the form against how estimates actually get booked. Name, phone, email, property address and a short project description stay. Date of birth goes. The insurance details move out of the web form entirely and are collected later by phone when a claim is involved. Submissions go to a shared estimates inbox that two people monitor. The privacy policy is then drafted from that finished picture rather than from a template. The question that prompted the review is one any team can ask: "If someone filled out our form two years ago, where is their information today, and who could see it?"
Make the policy match the practice
The FTC's privacy and security guidance says that if a company makes privacy promises, expressly or by implication, the FTC Act requires it to live up to those claims, and it advises businesses to reread their privacy policy to make sure they are honoring what they pledged. A copied policy that describes practices you do not follow creates a gap between promise and reality.
That is why the drafting order matters. The person drafting the policy should not have to invent where submissions go, which vendors receive them, or how long they stay in an inbox. Those answers belong to whoever set up the form, the email routing and the tools behind them, and they should be written down before the policy is.
| Question to answer | Where the answer usually lives |
|---|---|
| What fields does each form collect, and why? | The form settings and the person who handles the inquiries |
| Where does each submission go (inbox, CRM, spreadsheet)? | The form's notification and storage settings |
| Who can read submissions? | Inbox and system access lists |
| Which outside services touch the data (email marketing, scheduling, analytics, chat)? | The site's installed tools and scripts |
| Will the address receive marketing email? | Whoever runs email marketing |
| How long are submissions kept, and how are they deleted? | Usually nobody, until someone decides |
Protect it in transit and in storage
The FTC guide recommends Transport Layer Security (TLS) encryption or another secure connection that protects information in transit. On a modern site that means the whole site runs over HTTPS, including the page with the form. That covers the trip from the visitor's browser to your platform. A secure connection is not a storage policy, though, and the other three principles still apply once the submission lands.
Lock it means limiting who can open the inbox or system where submissions sit. Pitch it means deleting what you no longer need instead of keeping every inquiry forever. Plan ahead means knowing what you would do if an account holding those submissions were compromised. If nobody can say where a two-year-old submission lives today, the retention plan is missing.
When the form feeds marketing email
Many forms include a newsletter checkbox, or the business later adds inquiry addresses to a mailing list. The FTC's CAN-SPAM compliance guide says the law covers all commercial messages, not only bulk email. Its requirements include not using false or misleading header information, telling recipients where you are located, telling them how to opt out, and honoring opt-out requests within 10 business days. It also says you remain responsible for monitoring what others do on your behalf.
Decide before launch whether a contact form submission alone puts someone on a list, or whether that takes a separate, clearly worded choice. Write that decision into the policy, and make sure the email platform's settings match it.
Rules that vary by state and by industry
State privacy laws differ in who they cover and what they require, and the list can change as legislatures act. Do not rely on a single template to cover every state where your visitors live. Healthcare, financial and other regulated businesses may have additional obligations, and the FTC's own privacy guidance treats areas such as health information separately. Bring your completed answers table to counsel and ask which rules apply.
Hudson South builds websites around the same four steps as its content work: Authority Asset gathers approved business knowledge and evidence, Hudson Twenty-One records how the business communicates across 21 dimensions so the writing sounds like it, Market Intelligence researches the buyer questions and the market, and AEO Creation turns those inputs into answer-first content. Form submissions emailed to the business are part of the build practice, which makes the routing question above a planning item rather than an afterthought. For the next step after collection, read how website forms should route leads so none get lost, and for form labels and error messages see accessibility standards for business websites. The website builds overview covers the rest of the process.
Know what your forms collect before you launch
On a free 30-minute call, Hudson South compares your site with the competitors your buyers also consider and talks through what the rebuild needs to plan for.
Get your free competitor analysisSources
- Protecting Personal Information: A Guide for Business. Federal Trade Commission. Read 2026-10-17.
- Privacy and Security. Federal Trade Commission. Read 2026-10-17.
- CAN-SPAM Act: A Compliance Guide for Business. Federal Trade Commission. Read 2026-10-17.