Last updated: October 29, 2026 · By Alex Sandev, Founder of HiveSourced. This is general information, not legal advice.
Short answer: most US therapists seeing US clients do not need to build a website around the GDPR. The law applies to a US practice only in specific cases, such as deliberately offering services to people in the European Union. What nearly every practice does need is an accurate privacy policy, a clear cookie and analytics disclosure, and a HIPAA notice if you are a covered entity.
Key takeaways
- The GDPR can reach a business outside the EU when it offers services to people in the EU or monitors their behavior there (Article 3).
- A US-only practice with US clients usually falls outside that test. Offering sessions to clients living in Europe changes the answer.
- The FTC says that if you make privacy promises, you have to live up to them, so your privacy policy must match what your site really does.
- HIPAA covered entities that run a website must post their Notice of Privacy Practices on it.
- Not sure which rules apply to you? Ask a privacy attorney. Our HIPAA email and forms guide covers the technical side.
Does the GDPR apply to a US therapist?
The GDPR is the European Union’s data protection law. Article 3 says it can apply to organizations outside the EU in two cases. The first is “the offering of goods or services, irrespective of whether a payment of the data subject is required” to people in the EU. The second is “the monitoring of their behaviour as far as their behaviour takes place within the Union.”
In plain terms: a therapist in Ohio who sees Ohio clients is not targeting the EU. A therapist who advertises online sessions to people living in Europe, or who runs tracking that follows visitors in the EU, is closer to the line. Being reachable from the EU is not the same as aiming at it, but how your site is worded and who you serve both matter.
When should you take the GDPR seriously?
| Situation | GDPR likely relevant? | What to do |
|---|---|---|
| US practice, US clients, no EU marketing | Usually not | Focus on HIPAA and your state rules. Keep an accurate privacy policy. |
| You see clients who live in the EU by video | Possibly | Ask a privacy attorney before you accept them. |
| Your site is written for people in Europe (language, currency, EU pricing) | Possibly | Get legal advice and consider EU-specific consent tools. |
| Retreats or events held in the EU | Possibly | Treat registrations and payments as in scope and get advice. |
| US expats asking for sessions | Depends on where they live | Check where the client is located when they inquire. |
If any row above sounds like you, the safest step is a short review with a privacy attorney who knows both HIPAA and EU rules. Therapist websites carry health information, which makes the cost of guessing higher than for most small businesses.
What does a US therapist website need in its privacy policy?
Whatever the GDPR answer is, you still need a privacy policy that tells the truth. The FTC puts it directly in its privacy and security guidance: if you make privacy promises, the FTC Act requires you to live up to them, and it urges businesses to reread their policy to confirm it describes their practices accurately.
- What you collect: contact form answers, email address, appointment details, and analytics data.
- Why you collect it: to reply to inquiries, schedule sessions and improve the site.
- Who receives it: your form tool, your scheduling tool, your email provider and your analytics tool.
- How long you keep it: a plain statement, based on your record-keeping rules.
- How to reach you: an email or phone number for privacy questions.
- When you last updated it: a visible date.
Do not copy a generic template and hope it fits. A policy that promises “we never share data” while your site loads an advertising pixel is the kind of mismatch the FTC warns about.
Do you need a HIPAA Notice of Privacy Practices on your site?
If you are a HIPAA covered entity, yes. Under 45 CFR 164.520, a covered entity that maintains a website with information about its services “must prominently post its notice on the web site.” Many solo therapists bill insurance electronically, which usually makes them covered entities, but confirm your own status.
A website privacy policy and a Notice of Privacy Practices are different documents. The notice explains how you use and disclose client health information. The website policy covers what the site collects from visitors. Link both from your footer.
How should cookies and analytics be disclosed?
List the cookies and trackers your site actually uses, then say so in plain language. If you run analytics, say it is limited to public pages and that form answers are never sent to it. Our guide on Google Analytics and HIPAA explains which pages to keep tracking off.
A cookie banner is not a magic fix. A banner that says “we respect your privacy” while advertising pixels fire before anyone clicks is worse than none. If you serve EU visitors, ask your attorney what consent mechanism is required, and set the tools to wait for consent.
What about US state privacy laws?
Some US states have their own consumer privacy laws, and how they treat health information that is already covered by HIPAA varies. The rules differ by state and change often, so check your own state’s attorney general or a local attorney. A site that is honest, minimal and well documented is in good shape under almost any of them.
A practical privacy checklist for your therapy website
- Write a privacy policy that matches what your site really collects.
- Post your HIPAA Notice of Privacy Practices if you are a covered entity.
- List every tracker, including those added by plugins and embeds.
- Keep analytics and ad pixels off forms, booking steps and portals.
- Decide whether you will take clients who live in the EU, and say so on your site.
- Add a clear way for visitors to ask privacy questions.
- Review all of this twice a year.
How does HiveSourced help?
Every HiveSourced build includes a HIPAA-compliant contact form and a conversation about which pages should be tracked. We can place your privacy policy and notice in the footer and document what is installed. We do not give legal advice, so we recommend an attorney for the policy wording. See custom websites for therapists, pricing and the therapist website security checklist.
Frequently asked questions
Does a US therapist need to be GDPR compliant?
Usually not, if you serve US clients and do not market to people in the EU. Article 3 of the GDPR reaches organizations outside the EU only when they offer services to people in the EU or monitor behavior there. Ask an attorney if you take clients who live in Europe.
Do I need a cookie banner on my therapy website?
It depends on which trackers you run and who visits. If you serve EU visitors, consent rules may apply. If you do not, a clear disclosure in your privacy policy is still a good practice. Get legal advice for your situation.
Is a privacy policy required for a therapist website?
Having one is standard practice, and if you make privacy promises the FTC says you must keep them. HIPAA covered entities must also post their Notice of Privacy Practices on their website.
What is the difference between a privacy policy and a Notice of Privacy Practices?
The Notice of Privacy Practices is a HIPAA document about how you use and share client health information. The privacy policy describes what your website collects from visitors, such as analytics and form data.
Can I take clients who live in Europe?
Possibly, but it may bring the GDPR into play. Talk with a privacy attorney first, and check the licensing rules for where the client is located. Our guide to telehealth across state lines covers the licensing side within the US.
Where can I get help setting this up?
Tell us about your practice on the contact page and we will talk through your site’s privacy setup.
