A blog feels like it collects nothing. There is no checkout and no account, and the writer's mental model is a page being read. In practice a typical blog runs analytics, embeds video and social posts, accepts comments, collects email addresses and carries affiliate links, and every one of those is a different kind of collection with a different thing to disclose.
The five collectors on an ordinary blog
Analytics, which sets an identifier and records what was read. Embeds from video and social platforms, which usually set their own cookies the moment the page loads rather than when the user presses play. Comments, which take a name, an email address and an IP address and publish part of that. The mailing list, which takes an address and records opens and clicks. And affiliate or advertising links, which pass an identifier to somebody else. A policy that describes only the mailing list is describing a fifth of the site.
Comments are publication, not just collection
A comment form collects a name and an email and then publishes the name next to the text, often forever and usually indexed. Say that plainly: what is published, what is kept privately, how long, and how somebody gets their comment removed. Most comment systems also set cookies to remember the commenter, and many are hosted third party services, which makes them a recipient to name.
Affiliate and advertising disclosure sits beside the policy
Where a blog earns from links, the FTC's endorsement guidance requires the connection to be disclosed clearly and conspicuously, near the recommendation rather than buried in a policy page. That is a separate duty from the privacy notice and a different document, but it belongs in the same review, because both are statements about the business's relationship with the reader and both go stale when the monetisation changes.
The email list is the part with rules of its own
Commercial email in the United States is governed by CAN-SPAM, which requires an unsubscribe route that works, honouring it promptly, accurate headers and a physical postal address in the message. None of that lives in the privacy policy, but the policy has to describe the list, the tracking behind it and how to get off it, and the two should agree. A policy that promises an instant unsubscribe and a mailing tool that takes a week is the contradiction people write in about.
Questions people ask about privacy policy for blogs
Does a blog with no mailing list need a policy?
If it runs analytics, embeds or comments, yes. California requires a conspicuously posted policy of a commercial site collecting personally identifiable information about its residents, and an analytics identifier is collection.
Do embeds really collect before the user presses play?
Commonly, yes. Loading the embed loads the platform's script, which can set identifiers on page load. If that matters to you, the fix is a click to load placeholder rather than a paragraph in the policy.
Is an affiliate disclosure part of the privacy policy?
No. It is a separate disclosure that has to be near the recommendation itself. The privacy policy covers what data the affiliate link passes on.