Privacy Statement for Surveys and Questionnaires
A website privacy policy and a survey privacy statement solve different problems. Here's what a survey actually needs, and why the two shouldn't be the same document.
Last updated: August 2026
Why a survey needs different language than a website
A website privacy policy is mostly about ongoing collection: cookies, analytics, account data, things that happen every time someone visits. A survey is a single, bounded interaction. The person answers a set of questions once, and what matters to them is narrower and more specific: Is this anonymous? Who sees my answers? Can I skip a question? How long do you keep this?
Pasting a generic website privacy policy above a survey answers none of those questions and raises new ones (why is this survey talking about cookies?). It also reads as boilerplate, which tends to lower response rates rather than build trust in exactly the moment you're asking someone for their time and honesty.
What to include in a survey privacy statement
A good survey statement is short, usually a paragraph or two, and covers:
- Who's running it. Your name or organization.
- What it's for. Market research, academic research, internal feedback, whatever the actual purpose is.
- Whether it's anonymous. State this plainly, one way or the other.
- That participation is voluntary. People can skip questions or stop without consequence.
- Who else might see the responses. A research partner, a client, an academic committee.
- How long you keep the data. Even a rough answer ("until the project concludes") is more useful than silence.
- How to ask questions. A contact method for anyone with concerns.
Anonymous vs. identifiable responses
This is the single most important thing to get right, because it changes what you're allowed to promise. If you collect an email address to send a follow-up, or if the survey platform logs IP addresses by default, the survey isn't fully anonymous even if you never ask for a name. Say so. "Anonymous" is a specific claim, and overstating it is the kind of thing that erodes trust fast if someone notices the platform collected more than the statement described.
If you're not sure what your survey platform collects automatically, check its own documentation before you finalize your statement. Google Forms, Typeform, and SurveyMonkey all handle this differently by default.
Where to put it
At the very start of the survey, before the first question, not linked from a footer someone has to go looking for. A single sentence with a link to the fuller statement works well: "This survey is anonymous and takes about five minutes. Read our full privacy statement here." People decide whether to participate in the first few seconds, so this is not the place for a wall of text.
Frequently asked questions
Do I need this for an internal team survey?
It's good practice even for internal feedback surveys, especially anything touching sensitive topics like management feedback or workplace concerns. A short statement about anonymity and confidentiality tends to get more honest responses.
What if my institution already requires specific consent language?
Use theirs. If you're running research through an institutional review board (IRB) or a similar ethics process, their required language takes priority over anything generated here.
Can I combine this with my website's regular privacy policy?
You can link to your website privacy policy for general site information, but the survey itself should still carry its own short statement addressing anonymity, voluntary participation, and data retention specifically. Those aren't things a general website policy usually covers.