In a word, absolutely. A privacy policy isn't just about telling your users what they can expected from your website, products, and services. It's about protecting you against potential liabilities that could arise from those aspects. It doesn't even have to be the users that go after you but also government agencies since they can be real sticklers for details.
More than the actual consequences of not having a privacy policy, it also helps to legitimize your website's authority if you have one. It just comes parts and parcel with having a successful online business.