A Privacy Policy is required in the US if you collect or use personal information. There are a number of laws that require this, including California's CalOPPA and the CPRA, Virginia's CDPA, Maryland's PIPA and New York's SHIELD.