I've built a few sites that aren't huge but definitely pass the 1 million unique user/month mark. Most were content sites, ad-supported. The only time a privacy policy was ever brought up was when Remnant Ad providers required them.
As suggested in other comments, I'd say put up a generic ToS, apologize for anything that comes in, and pay for a lawyer to analyze it when you really have the money to do it.
And to answer your question, $1.5-2k is fairly standard for a document like this.
As suggested in other comments, I'd say put up a generic ToS, apologize for anything that comes in, and pay for a lawyer to analyze it when you really have the money to do it.
And to answer your question, $1.5-2k is fairly standard for a document like this.