![Only 34% of Websites Publish a Privacy Policy [2026]](/_astro/blogger-legal-pages-statistics-2026.D___13m__Z2qfSVs.webp)
Only 34% of websites make a privacy policy available at all, according to a 2023 Penn State University study that crawled millions of English-language sites using a capture-recapture methodology, the closest large-scale estimate available for how many personal blogs and small sites carry the page. That gap has not gone unnoticed by regulators: the FTC finalized its first major update to the Endorsement Guides since 2009 in June 2023, extending clear disclosure requirements to bloggers' affiliate links and sponsored posts.
Below is what that 34% figure actually measures, how many bloggers have installed compliance tooling anyway, what the FTC has done to enforce affiliate disclosure, and what a self-reported survey of already-compliant site owners looks like next to it.
What percentage of websites actually have a privacy policy?
Only 34% of websites make a privacy policy findable at all. That figure comes from a Penn State College of Information Sciences and Technology study, "Privacy Lost and Found: An Investigation at Scale of Web Privacy Policy Availability," which won a Best Student Paper Award at the 2023 ACM Symposium on Document Engineering. The research team crawled millions of English-language websites and used a capture-recapture methodology, borrowed from wildlife population estimation, to correct for policies a single crawl would miss. No study of comparable scale has repeated the measurement since, so treat 34% as the most recent large-scale figure available rather than a live number, and note that it covers all websites, not blogs specifically, since no study has isolated personal blogs as their own category.
Even the policies that do exist are not always reliable: the same study found 2% to 3% of the links pointing to a site's privacy policy are broken, and another 5% of working links lead to content that has nothing to do with privacy, such as a generic terms page or a dead redirect. A visitor, or a regulator, checking for a policy has a real chance of finding nothing usable even on a site that technically has one.
Do bloggers actually need a privacy policy?
For most blogs that use analytics, run ads, or collect visitor data through a contact or comment form, yes. GDPR's exemption for "purely personal or household activity" is narrow, and a publicly accessible blog that runs ads or affiliate links falls outside it. CCPA works differently: it exempts most solo bloggers through its revenue and data-volume thresholds (adjusted to $28,275,000 in annual gross revenue for 2026), but a blog with any EU readership still needs to address GDPR regardless of size.
Figure 1: The compliance path a monetized blog follows under GDPR and the FTC's Endorsement Guides. Source: GDPR Article 2(2)(c), FTC Endorsement Guides (2023 revision).
A blogger who wants to close that gap without guessing at legal language can generate a privacy policy that names every analytics tool, ad network, and data-collecting form on the site.
Has the FTC gone after bloggers or influencers?
Yes, and the FTC's authority to do so got substantially clearer in 2023. The commission finalized its first major revision of the Endorsement Guides since 2009 in June 2023, explicitly extending disclosure obligations to influencer posts, affiliate links, and fake or incentivized reviews. Five months later, in November 2023, the FTC sent warning letters to a dozen health influencers and dietitians, plus two trade associations, for social media posts promoting aspartame or sugar consumption without adequately prominent disclosure of the paid relationship behind them.
Figure 2: FTC enforcement and guidance milestones affecting bloggers and influencers. Source: Federal Trade Commission press releases, 2009 to 2023.
The financial exposure is not theoretical. A non-compliant endorsement or affiliate disclosure can carry a civil penalty of up to $50,120 per violation under the FTC's current, inflation-adjusted guidance, a figure that applies per post, not per campaign.
How many bloggers have actually installed compliance tooling?
WordPress powers roughly two in five websites, and its plugin ecosystem gives a rough floor on how many site owners have taken at least the first step toward compliance. CookieYes, the most-installed cookie and privacy-policy plugin, reports 1,000,000-plus active installs directly through WordPress.org's own install counter, and Complianz separately reports over 1,000,000 users. Two more widely used plugins, GDPR Cookie Compliance and WPConsent, add 300,000 and 100,000-plus active installs respectively.
Figure 3: Active install counts for the leading WordPress cookie and privacy compliance plugins. Source: WordPress.org plugin directory.
These install counts are a floor, not a percentage: WordPress.org reports installs in open-ended bands rather than exact figures, and an install does not guarantee the plugin was ever configured with real, site-specific policy language. Still, several million separate WordPress installations having installed dedicated compliance tooling is a meaningful signal that at least a portion of the blogging world already recognizes the gap the Penn State study measured.
What does self-reported blogger compliance look like?
Among site owners who had already sought out a compliance tool, reported adoption is much higher than the 34% baseline. A 2024 Termly survey of 1,037 respondents across 92 regions, about half of whom identified as digital businesses including apps, SaaS products, and blogs, found 89.6% had a privacy policy, 82.4% had terms and conditions, and 63% had a cookie policy.
Figure 4: Legal pages published, self-reported by site owners already using a compliance tool. Source: Termly, Data Lab survey, 2024.
That gap between 34% and 89.6% is the whole story: it is not that legal pages are hard to build once a blogger decides to build one, it is that most blogs never reach the point of deciding to. Termly's own respondents were already customers who had sought out a compliance solution, so the 89.6% figure describes a self-selected, already-motivated group rather than blogs generally.
| Measure | Share | Source |
|---|---|---|
| All websites with a findable privacy policy | 34% | Penn State, 2023 |
| Working privacy policy links that are broken | 2% to 3% | Penn State, 2023 |
| Already-compliant site owners with a privacy policy | 89.6% | Termly, 2024 |
| Already-compliant site owners with a cookie policy | 63% | Termly, 2024 |
The Bottom Line
The 34% figure is the single most important number for a blogger to know, not because it describes bloggers specifically, but because it describes the baseline a blog is measured against the moment it starts running ads, tracking visitors, or publishing sponsored content. The FTC has made its expectations for disclosure explicit since 2023, and the penalty structure behind non-compliance is real money, not a formality. A blog does not need a legal team to close this gap. It needs one accurate page that names what data it collects and one clear line on every sponsored post disclosing the relationship behind it.
Frequently Asked Questions
What percentage of websites have a privacy policy? Only 34% of websites make a privacy policy available at all, according to a Penn State University study that crawled millions of English-language sites using a capture-recapture methodology, published in 2023. No larger-scale replication has been published since.
Do bloggers legally need a privacy policy? In most cases, yes, once a blog uses analytics, ad networks, or a contact or comment form that collects visitor data. GDPR applies regardless of size or revenue if EU visitors are tracked, and the FTC has separately required clear disclosure of affiliate and sponsored content since its updated Endorsement Guides took effect in June 2023.
Has the FTC ever taken action against bloggers or influencers? Yes. In November 2023, the FTC sent warning letters to a dozen health influencers and dietitians, plus two trade associations, for failing to adequately disclose paid promotional posts about aspartame and sugar. Non-compliant disclosures can carry a civil penalty of up to $50,120 per violation.
How many bloggers use a dedicated privacy or cookie compliance tool? At least several million WordPress sites have installed one, based on public install counts: CookieYes and Complianz each report 1,000,000-plus active installs, and two more leading plugins add several hundred thousand more combined. That is a floor on tooling adoption, not a percentage of all blogs with a working policy.
This post continues a look at how small, independent website operators handle legal compliance. See Charity Privacy Compliance 2026 for how a different category of small organization compares, and Small Business Privacy Statistics 2026 for the broader small-business picture. A companion post on freelancer websites and privacy notices is planned for this cluster but not yet published on this site.
Where the Numbers Come From
- Penn State College of Information Sciences and Technology. (2023). "Privacy Lost and Found: An Investigation at Scale of Web Privacy Policy Availability." Best Student Paper Award, ACM Symposium on Document Engineering (DocEng '23).
- Federal Trade Commission. (2023). "Federal Trade Commission Announces Updated Advertising Guides to Combat Deceptive Reviews, Endorsements." First major Endorsement Guides revision since 2009.
- Federal Trade Commission. (2023). "FTC Warns Two Trade Associations and a Dozen Influencers About Social Media Posts Promoting Consumption of Aspartame or Sugar."
- WordPress.org. "CookieYes: GDPR Cookie Consent, CCPA & GDPR Compliance." Plugin directory listing, 1,000,000-plus active installs.
- WordPress.org. "GDPR Cookie Compliance." Plugin directory listing, 300,000-plus active installs.
- Termly. (2024). "How Businesses Feel About Data Privacy." Data Lab survey of 1,037 respondents across 92 regions, fielded January to February 2024.
- Federal Trade Commission. (2017). "FTC Staff Reminds Influencers and Brands to Clearly Disclose Relationship."
Note: All figures verified as of September 2026. The Penn State 34% figure is the most recent large-scale study of privacy policy availability across the general web; it measures all websites rather than blogs as a distinct category, and no comparable-scale replication has been published since 2023. This post's figures are refreshed at least twice a year to track new FTC enforcement and survey data.
