Page one for this question is web-design vendors selling policy generators. None of them looked at what ranking contractor sites actually do, so on 15 September 2026 I fetched 39 of them and counted.
Yes, once the site collects something. A quote form takes a name, a phone number and often an address. Google Analytics and the Meta pixel take browsing data through cookies. Both of those platforms require a policy or a notice in the terms you accept when you install them — that is a contract you signed, before any question of law comes up.
It is also the normal thing to have. Of the 39 top-ranked Grand Rapids trade sites I fetched on 15 September 2026, 23 link to a privacy page: 6 of 10 plumbers, 7 of 10 roofers, 7 of 10 HVAC companies and 3 of 9 electricians.
The gap is narrower than the headline. 26 of the 39 served a form on the home page, and 6 of those 26 had no privacy link on it at all — collecting a name and a number with nothing on the page saying where it goes. This article is not legal advice; for that, ask a lawyer.
Search the question and you get a wall of posts from website companies, most of them ending at a link to a policy generator. They agree that you probably need one. None of them checks whether the businesses already winning the search have one, which is the only version of the question a contractor is actually asking: is this a real thing or is someone selling me something?
So I measured it, in one city, for the four trades that call me most.
The set is the 40 businesses Google Maps ranked in its first ten for plumber, roofing company, HVAC company and electrician in Grand Rapids, read on the morning of 15 September 2026. Between 17:15 and 17:21 UTC that day I fetched each business's own home page once with a plain HTTP request — no browser, no retries. One electrician's site timed out at twenty seconds and was left out, which is why the denominator is 39 and not 40.
The privacy check is deliberately generous: it counts a home page as having one if any link on it has the word privacy in its text or its address. A footer link labelled "Privacy Policy" counts. Nothing about the quality or the contents of the linked page is measured.
| Trade | Have a privacy link | Sites measured | Share |
|---|---|---|---|
| Plumbers | 6 | 10 | 60% |
| Roofers | 7 | 10 | 70% |
| HVAC | 7 | 10 | 70% |
| Electricians | 3 | 9 | 33% |
| All four trades | 23 | 39 | 59% |
Two things fall out of that table. The first is that a privacy page is ordinary rather than exotic: in three of the four trades, most of the businesses ranking above you have one. The second is that electricians are the outlier — 3 of 9, against 6 or 7 of 10 everywhere else. I have no explanation for that from this data, and nine sites is a small enough number that it may be nothing. It is what the file says.
A privacy page is not a decoration you add because competitors have one. It exists because something on the site is taking information from the visitor. So the more useful cut of the same 39 sites is by whether the home page serves a form at all.
| Home page | Have a privacy link | Sites measured | Share |
|---|---|---|---|
| Serves a form | 20 | 26 | 77% |
| No form in the HTML | 3 | 13 | 23% |
The pattern is what you would hope: the sites that collect something are more than three times as likely to disclose it. But the interesting cell is the one the ratio hides. Six sites serve a form and link to no privacy page anywhere on the home page — two plumbers, one roofer, one HVAC company and two electricians. Those six are asking a homeowner for a name, a phone number and usually an address, on a page that says nothing about what happens to it.
The question is not whether your competitors have a privacy page. It is whether your site takes anything from the person reading it.
Three of the thirteen sites with no form still carry a privacy link, which is also sensible — a form is not the only way a page collects. Analytics, an advertising pixel, a chat widget, a call-tracking script and an embedded map all hand something about your visitor to a third party without anybody typing a word.
Before anyone argues about law, there is a simpler layer: the contracts you accept when you paste those scripts onto your site. Both of the common ones say something specific, and both are public.
Google's Analytics terms of service, section 7: "You must post a Privacy Policy and that Privacy Policy must provide notice" of your use of cookies and device identifiers used to collect data (marketingplatform.google.com/about/analytics/terms/us/, read 16 September 2026).
Meta's Business Tools Terms go further and attach the requirement to the pages themselves, asking for "a clear and prominent notice on each web page where our pixels are used" that links to an explanation of the collection and what Meta does with it (facebook.com/legal/terms/businesstools, read 16 September 2026).
That is worth reading twice if you run Meta ads. The obligation is not "have a policy somewhere"; it is a notice on every page carrying the pixel, which in practice means a footer link on the whole site rather than a link buried on the contact page. This site does it that way for exactly that reason.
These are platform terms, not statutes, and quoting them is not a legal opinion. Whether any law applies to your business depends on where your customers are and what you collect, and that is a question for a lawyer, not a web designer. What I can tell you without hedging is that if you installed Analytics or the Meta pixel, you agreed in writing to disclose them.
Reading those two documents back to back, the disclosure they are asking for is short and specific. In plain terms, a contractor's privacy page needs to answer four questions a homeowner could reasonably ask:
None of that requires four thousand words of boilerplate, and the generated policies that run that long often describe data practices the business does not have. A page that accurately describes a two-field quote form is worth more than a template that mentions ad networks you have never used. Ours is at /legal/privacy.html if you want to see the shape of it.
Being exact about the limits matters more here than usual, because the topic invites overstatement.
Worth saying plainly, because it decides whether this is your problem or your builder's. Our Starter build at $999 includes a lead form and click-to-call, which means a Starter site is collecting from day one. The Business build at $2,499 adds local schema, reviews and analytics — and analytics is the second trigger, the one that brings Google's section 7 into it. The care plan runs $199/mo.
What the published package list does not say is that a privacy page is included, so I am not going to claim it here. Ask for it — when you are getting a quote from anyone, ours included, ask whether a privacy page is part of the build and whether the link will sit in the site-wide footer. It is a small piece of work and a short conversation, and the answer tells you whether the person quoting you has read the terms they are about to have you agree to.
Measurement. builtbykerr.com site sweep, 15 September 2026. Forty businesses taken from four Google Maps lists (plumber, roofing company, HVAC company, electrician; Grand Rapids, MI; first ten of each), read that morning. One HTTP fetch of each business's own home page between 17:15 and 17:21 UTC the same day, no retries, no JavaScript rendering. One site timed out at twenty seconds and is excluded, leaving 39 measured. Privacy link = any anchor whose href or text contains "privacy"; form = a <form> tag in the served HTML. Counts are reported per trade; no business is named.
Pages quoted, both read 16 September 2026. Google Analytics Terms of Service, section 7 (marketingplatform.google.com/about/analytics/terms/us/). Meta Business Tools Terms (facebook.com/legal/terms/businesstools).
If the site collects anything from a visitor or runs any tracking, treat it as yes. A contact or quote form collects a name, a phone number and often an address. Google Analytics and the Meta pixel collect browsing data through cookies and similar identifiers, and the terms you accept when you install them require you to post a policy and to give visitors notice on the pages that run it. A brochure site with no form, no analytics, no advertising pixel, no chat widget and no embedded map is the only common case where nothing is being collected. This page is not legal advice.
The two sets of platform terms we read ask for specific things. Google's Analytics terms require you to post a privacy policy that gives notice of your use of cookies, mobile device identifiers or similar technology used to collect data. Meta's Business Tools terms require a clear and prominent notice on each page where the pixel runs, linking to an explanation that third parties including Meta collect information from your site and use it for measurement and advertising. Beyond those two, say in plain words what your form collects, what you do with it, and how someone reaches you about it.
Fewer sites are in that position than owners think. Of the 39 top-ranked Grand Rapids trade sites measured on 15 September 2026, 26 served a form in the home page HTML. A site with no form can still collect through analytics, an advertising pixel, a chat widget, a call-tracking script or an embedded map, and each of those is a third party receiving something about your visitor. If none of those are present, nothing is being collected and there is nothing to disclose.
In our sweep, 23 of 39. By trade: 6 of 10 plumbers, 7 of 10 roofers, 7 of 10 HVAC companies and 3 of 9 electricians linked to a privacy page from their home page. Among the 26 sites that served a form, 20 had a privacy link and 6 did not. The measurement records the presence of a link whose text or address contains the word privacy, not what the linked page says.
Send me your URL. I'll tell you what the page actually loads — forms, analytics, pixels, chat, maps — and whether anything on it is disclosed.
Works whether or not you end up building with me.