gdpr
The obligation to provide a privacy policy stems from GDPR Articles 13 and 14. When the information has to be provided depends on when personal data is obtained.
Information under Art 13 (data obtained directly from the data subject) must be provided at the time when the personal data is being obtained. Since most websites will obtain personal data pretty much continuously, they will likely have to keep this information available continuously as well.
Information under Art 14 (data obtained from other sources) must be provided within a reasonable time after obtaining the information, but at the latest when the data subject is contacted.
So this depends very much on when data is obtained, and whether personal data is obtained directly from the data subject. E.g. a website generally obtains some personal data directly from the data subject every time a user visits the page, thus it will likely have to keep a minimal privacy policy available all the time, for all visitors (whether registered or not). In contrast, for individual instances of personal data processing, it may be sufficient to provide the information only once. For example, if we ask a user to enter information to enter a raffle, the privacy policy regarding the raffle might only have to be shown in context of the form where the user can enter data.
However, all such approaches stink. Doing the bare minimum that's explicitly required is an easy way to run afoul of more foundational GDPR principles, e.g. the Art 5(1)(a) requirement that all data processing must be transparent (compare also Art 12(1)), and the Art 5(2) accountability principle: the data controller must be able to demonstrate how what they're doing is compliant.
The Art 13 and 14 time frames are the latest point in time at which this information has to be actively provided to the user (compare also the guidelines on transparency WP260). But it would be entirely possible for a court to argue that the transparency principle implies that all such information must be available to the user for the duration of all related processing activities, possibly both before and after the data subject was explicitly informed. The WP260 document also emphasizes that the data controller must take the reasonable expectations of the users into account, and most users expect a “privacy policy” link in the footer of every page.
As a more general point, the GDPR never requires that data subjects agree to a privacy policy. A privacy policy is largely unidirectional information, not a contract. Under some circumstances, the data controller may rely on consent as a legal bases for processing, and will then have to obtain consent from the data subject. In the course of this, it is necessary to provide information about the specific processing activities for which consent is being asked. Usually, this is done by a short summary with key information, and a link to the privacy policy for the full details (a layered privacy notice, compare the WP260 document and the EDBP guidelines on consent 05/2020). But valid consent can only be obtained for specific processing activities, not for a bundle of processing activities or a privacy policy in its entirety.
