GDPR for small-business websites: the practical guide (cookies, forms, analytics)

For a small-business website in the EU, GDPR compliance comes down to six things: no non-essential cookies or trackers before the visitor consents, with refusing as easy as accepting; a clear privacy notice; forms that collect only what you need, for a stated purpose and legal basis; analytics and ad tags wired to respect consent; contracts with the providers that handle your data; and a plan for data breaches. None of this requires a legal department. It does require knowing exactly what your site loads and where your data goes. This guide takes each point in turn and ends with the order to fix things in.

This is a practical summary for business owners, not legal advice. National rules differ, so check your own data protection authority's guidance or ask a lawyer for your specific case.

Which rules apply to your website

People often say "GDPR" for everything, but two layers apply.

• The ePrivacy rules (Article 5(3) of the ePrivacy Directive, transposed into each country's national law) govern storing or reading anything on a visitor's device: cookies, local storage, pixels and similar technologies.
• The GDPR governs what you do with personal data afterwards, and defines what valid consent means.

The European Data Protection Board's cookie banner taskforce summarized the relationship in 2023: the national law transposing the ePrivacy Directive applies to placing or reading cookies, the GDPR applies to the processing that follows, and GDPR concepts such as valid consent are used to judge both. Because the cookie part is national law, details can vary between member states. That's why your local authority's guidance matters.

Cookies and the consent banner

The basic rule

The taskforce put it plainly: by default, no cookies that require consent can be set without consent, and consent must be a positive action by the user. Strictly necessary cookies (a shopping cart, a login session, security, remembering a visitor's consent choice or language preference) don't need consent. Analytics, advertising, social media pixels, heatmaps and most embedded third-party content do.

What regulators flagged in real banners

The same EDPB report lists practices that national authorities found problematic:

• No reject option. A first layer with "Accept" and "Settings" but no way to refuse. A vast majority of authorities considered that the absence of a reject option on any layer that has an accept button is not valid consent.
• Pre-ticked boxes. Pre-ticked options in the settings layer don't give valid consent. The GDPR's recital 32 says silence, pre-ticked boxes or inactivity are not consent.
• Reject as a hidden link. A "refuse" or "continue without accepting" link buried in text, or outside the banner, without enough visual weight next to the accept button.
• Deceptive design. Reject buttons with contrast so low the text is unreadable.
• "Legitimate interest" for ad profiling. Using legitimate interest as the legal basis for placing cookies is not allowed.
• "Essential" cookies that aren't. Labelling analytics or marketing cookies as strictly necessary. Website owners are expected to keep a list of their cookies and be able to justify each one.
• Hard-to-find withdrawal. People must be able to withdraw consent at any time, as easily as they gave it, for example through a small permanent icon or a clearly placed link.

A banner that passes

In practice: "Accept all" and "Reject all" on the first layer with equal prominence, a "Settings" option for categories, nothing non-essential loading until a choice is made, the choice remembered, and a footer link or icon to change it later. Then test it: open your site in a private window, click reject, and check in the browser's developer tools that no analytics or advertising cookies appear.

The privacy notice

You must tell people, at the moment you collect their data, how you use it. The European Commission lists what the information must include:

• Your business name and contact details, and your data protection officer's details if you have one.
• The purposes of the processing and the legal basis for each.
• The categories of personal data involved.
• How long you keep the data.
• Any automated decision-making and its consequences.
• People's rights, such as access and erasure, and their right to complain to a data protection authority.

Write it for your actual site. A template copied from a larger company lists tools you don't use and misses the ones you do. Name your real providers (hosting, email platform, CRM, analytics, booking tool) and say where data goes.

Forms

Contact and quote forms are where most small-business websites collect personal data. Three principles do most of the work.

Pick the right legal basis

The GDPR offers six legal grounds: consent, contract, legal obligation, public interest, vital interests and legitimate interests. For a quote request, you usually don't need consent: answering the person's request is necessary to take steps toward a contract at their request. A newsletter sign-up is different and needs consent.

Collect only what you need

The GDPR's data minimisation principle means collecting only data that is adequate, relevant and limited to what is necessary for the purpose. For a callback, that's a name, an email or phone number and a message. Fields like date of birth or company size "for later" are hard to justify.

Keep purposes separate

If you want to add form senders to your mailing list, use a separate checkbox that is not pre-ticked. Valid consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.

Also decide how long you keep enquiries that never became clients. Under the storage limitation principle, data should be kept no longer than the purpose requires, so set a retention period you can justify and actually delete on schedule.

Analytics and advertising tags

Google Analytics, Google Ads and Meta pixels all set cookies or similar identifiers, so they fall under the consent rule.

Google's consent mode is the usual way to connect your banner to Google tags. Google's documentation describes four consent types, including ad_user_data (sending user data to Google for advertising) and ad_personalization (personalized advertising, including remarketing). It offers two setups:

• Basic: Google tags don't load until the visitor responds to the banner. If they refuse, no data is sent to Google at all.
• Advanced: tags load with consent set to "denied" by default and send cookieless measurements when the visitor refuses. Google uses them for modelling.

Separately, Google's EU user consent policy requires sites using its products for visitors in the EEA to obtain legally valid consent for cookies where the law requires it and for personalized ads, keep records of consent, explain how to revoke it, and identify each party that receives the data. If you run Google Ads to European audiences, a working consent setup is not optional.

If you want to avoid the question for basic traffic statistics, privacy-focused analytics tools that work without cookies or personal identifiers can reduce what needs consent. Check the specific tool and your national authority's position before relying on that.

Providers, contracts and transfers

Processors

Your web host, email marketing platform, CRM, form tool and booking software process personal data on your behalf. Under the GDPR they are processors, and you need a data processing agreement with each. Most established providers publish one; accept it, save a copy, and keep a simple list of who processes what.

Transfers outside the EU

When a provider stores or accesses data outside the EU, the transfer needs a legal basis. For the United States, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, which lets personal data flow freely to US companies that participate in the framework. For other countries or providers outside the framework, standard contractual clauses are the usual tool. Ask each provider which mechanism it uses.

Records of processing

The GDPR requires a record of your processing activities, with a limited exemption for organisations under 250 employees. In May 2025 the Commission proposed extending that exemption to organisations under 750 employees and limiting the obligation to high-risk processing, but it was presented as a proposal, so check whether it has been adopted. Even where you're exempt, a one-page list (what data, why, which provider, how long) makes every other obligation easier.

Data breaches

A hacked email account, a misconfigured form that exposes submissions, a lost laptop with client files: these are personal data breaches. Where a breach is likely to pose a risk to people's rights and freedoms, you must notify your data protection authority without undue delay and at the latest within 72 hours of becoming aware of it. If the risk is high, you must also inform the people affected. Your processors must tell you about every breach on their side.

Prepare now: know who decides, where your authority's notification form is, and keep a short log of incidents, even minor ones.

What happens if you get it wrong

Data protection authorities can issue reprimands, order changes, ban processing and impose fines of up to €20 million or 4% of total annual worldwide turnover for the most serious infringements, according to the European Commission. Fines at that level target large companies. For a small business, the realistic risks are a complaint to the authority, an order to fix your site, a smaller fine, and the time it takes to respond.

What to fix first

If you're starting from scratch, this order deals with the most visible issues first:

1. List everything your site loads and every provider that receives data from it.
2. Fix the cookie banner so that reject is as easy as accept and nothing non-essential runs before consent.
3. Connect consent mode if you use Google Analytics or Google Ads.
4. Rewrite the privacy notice to match the list from step one.
5. Trim your forms and add a separate, unticked box for marketing.
6. Collect data processing agreements from your providers and note their transfer mechanism.
7. Set retention periods and a short breach procedure.

Steps one to three are often a few days of work and remove most of the risk regulators actually look for on small-business sites.

How we can help

At PNE Solutions we treat these points as a normal part of building a site for a European business: a consent banner that actually blocks tracking until visitors choose, Google consent mode set up and tested, forms limited to what's needed, and a list of every tool that receives data. If your current site doesn't meet this bar, our website design work starts with that same inventory.

Sources

• Report of the work undertaken by the Cookie Banner Taskforce — European Data Protection Board
• Legal grounds for processing data — European Commission
• Obligations of companies and organisations — European Commission
• Enforcement and sanctions — European Commission
• EU-US data transfers — European Commission
• Data protection — European Commission
• Consent mode overview — Google for Developers
• EU user consent policy — Google