That depends on what kind of Web site you have. If you require personal information from your users (such as email addresses, home addresses, or credit card information), you should let them know what you intend to do with the information. This policy can be a part of the Terms of Use Agreement, but many sites have a separate Privacy Policy.

The Privacy Policy should address your rights to the use of any personal information from the user, and whether you will keep this information confidential or be able to use it for other purposes or provide it to other parties. Make sure that your Privacy Policy is not so restricted that you cannot disclose information if legally compelled to do so.

For legal reasons, it's important to provide a clear explanation of your policies. But you may find that being up-front with your users about your intentions may enhance your relationship with them.

You may also want to consider following the World Wide Web Consortium's Platform for Privacy Preferences Project (P3P). It provides a standard way for Web sites to present their privacy information not only in a readable format for humans but also in a format that browsers can recognize. Users concerned with privacy can specify that they do not want to go to sites that share user information, for example. P3P-compliant browsers can edit sites based on user criteria. You can check out the P3P guidelines at the W3C site.