Websites and apps that collect personal information must have a privacy policy due to legal requirements like GDPR, PIPEDA, and CalOPPA. Even if a site or app does not collect personal data directly, a privacy policy is still necessary if third-party services do collect data, as it keeps the site legally compliant and meets user expectations. The policy should clearly state what information is collected and how it is handled, even if it's brief.