Website policies is the collective name for the documents in the footer, and a small company usually has between one and four of them in some state of neglect. They are not variations on a theme. One is a contract, one is a statement of fact, one is an inventory and one is a set of rules, and knowing which is which tells you who owns it, how often it changes and what happens when it is wrong.
The privacy notice: a statement of fact
What personal data you collect, why, who receives it, how long you keep it, what rights people have and how to use them. It binds nobody and it is either true or false, which is the opposite of how a contract works. California requires a conspicuously posted policy of practically any commercial site collecting personal information about its residents, with no size threshold, so this is the one document nearly every site actually owes.
The cookie policy: an inventory
A list of what is stored on the visitor's device, by whom, for what and for how long. It goes stale the moment a tag is added, which is why it belongs in a separate document rather than as a table inside the privacy notice: an inventory has a different review cycle from a statement of purposes. Where consent is required for non-essential cookies, the banner is a separate piece of machinery again, and the policy describes it rather than being it.
The terms: a contract
What the service is, what it costs, what the user may not do, who owns what, what happens when something goes wrong. It only does anything once somebody has agreed to it, so the acceptance step and the record of it are worth more than any individual clause. It should be versioned and it should change rarely, which again is the opposite of the privacy notice.
Acceptable use: a set of rules, and where it lives
What a user may not do with the service: abuse, scraping, spam, illegal content, resale. On a small site it belongs inside the terms as a section, because a fourth document is a fourth thing to keep in sync. It earns its own page when the rules get long enough to need structure, or when a customer's procurement asks for it by name. Either way it is the document a suspension decision points at, so it should list specific prohibitions rather than general exhortations.
Questions people ask about website policies
Which of these are legally required?
The privacy notice, in practice, for nearly any commercial site with California visitors. Cookie rules bite where consent is required for non-essential cookies. Terms and acceptable use are optional and useful.
Can they be one page?
They can, and they then share a review cycle they should not share. The privacy notice changes when a tool changes; the terms should not move that often.
Who should own them?
One named person for all four, usually whoever owns the website, with a lawyer for the terms where real money or liability is involved. Shared ownership means nobody notices when one goes stale.
How often should they be reviewed?
The privacy notice on a change of tools and at least every twelve months where California's consumer privacy statute applies. The terms when the entity, the service or the money changes.