GDPR applies to every website that processes data from UK or EU users. Most small business websites have at least one compliance failure — usually analytics firing before consent. Here is what the law requires and how to check your site.
The most common failure by far. Google Analytics, Facebook Pixel and other tracking scripts must not fire until the user has actively accepted cookies. If your analytics loads on page load before any cookie banner interaction, you are non-compliant. Fix this in Google Tag Manager by triggering analytics tags only after a consent_update event.
A banner that only has an Accept button is non-compliant. The ICO requires that rejecting cookies is as easy as accepting them. Add a clear "Reject all" option at the same level as "Accept all" — not buried in a settings menu.
A privacy policy is not sufficient — you need a separate cookies policy that lists every cookie used, its name, purpose, provider and retention period. Your consent banner must link to this policy.
You must be able to prove consent was given if challenged. Your consent management platform should log when consent was given, what version of the policy was shown, and what the user consented to.
Run the GDPR Auditor — it checks for cookie banners, analyses which trackers load before consent, validates your privacy policy presence and checks security headers. The audit is free and takes under a minute.
This is the single most consequential misunderstanding in website compliance, and almost every "GDPR cookie banner" article gets it wrong.
In the UK, the rules on storing or accessing anything on a user's device — cookies, localStorage, sessionStorage, pixels, device fingerprinting — come from PECR (the Privacy and Electronic Communications Regulations), not from UK GDPR. In the EU the equivalent is the ePrivacy Directive. UK GDPR then governs what you do with the personal data those technologies collect.
Why does this matter in practice? Because PECR requires consent for anything that is not strictly necessary — and it does not offer the alternative lawful bases that GDPR does. This closes the loophole that a great many sites believe they are using:
The exemption covers storage that is essential to provide a service the user has explicitly requested. That is a short list:
Analytics is not on that list. The ICO has been explicit about this. The user did not request analytics; you did. However genuinely useful your traffic data is to you, and however anonymised it may be, the cookie still requires consent before it is set. "But it's only first-party analytics" and "but we've turned on IP anonymisation" are both true and both irrelevant to whether consent is needed.
Consent under UK GDPR has a definition, and it is specific: freely given, specific, informed, and unambiguous, given by a clear affirmative action. Each of those words has been litigated, and each of them kills a common banner design.
| Pattern | Verdict | Why |
|---|---|---|
| Pre-ticked consent boxes | Invalid | Not a clear affirmative action (settled by the CJEU in the Planet49 case, 2019) |
| "By continuing to browse you accept" | Invalid | Inactivity and scrolling are not consent |
| Accept button prominent, Reject buried in a settings menu | Invalid | Rejection must be as easy as acceptance — regulators have fined for exactly this |
| Cookies set before the banner is answered | Invalid | Consent must precede the storage, not follow it |
| No way to withdraw consent later | Invalid | Article 7(3): withdrawal must be as easy as giving |
| A single "Accept all" with no granularity | Usually invalid | Consent must be specific to each purpose |
Article 7(3) requires that withdrawing consent be as easy as giving it. A banner the user can dismiss in one click, with no mechanism ever to change their mind, fails this. You need a persistent, findable route back — a "Cookie settings" link in the footer, or a small persistent icon — that reopens the preference panel on any page. Most sites deploy a compliant banner and then omit the withdrawal path entirely.
Consent is not permanent. Regulator guidance is that it should be refreshed at reasonable intervals rather than stored indefinitely — a banner that asks once in 2021 and never again is not standing on solid ground. Re-prompting somewhere in the range of six to twelve months is the common interpretation. Check current ICO guidance rather than relying on whatever default your consent platform shipped with.
Most sites underestimate what is loading, because much of it was added by a plugin, a theme, or an embed that nobody audited.
youtube-nocookie.com domain reduces this, but the embed still contacts Google's servers on load. Treat video embeds as third-party trackers and hold them behind consent, replacing them with a click-to-load placeholder.The cookie banner is the visible part, so it absorbs all the attention. Several other obligations are less visible and more likely to be missed entirely.
Anyone can ask what personal data you hold on them, and you must respond within one month. This can be extended by two further months where the request is complex, but you must tell the individual within the first month that you are extending and why. It is free — you can only charge where a request is manifestly unfounded or excessive. There is no form and no required wording: a request can arrive as a sentence in an ordinary email, and the clock starts when it lands.
A personal data breach that poses a risk to individuals' rights and freedoms must be reported to the ICO within 72 hours of becoming aware of it. Where the risk is high, the individuals themselves must also be told, without undue delay. Seventy-two hours is not long to discover what happened, assess it and file — which is why an incident procedure written in advance is worth more than one improvised on a Friday night.
Every organisation that processes personal data on your behalf — your host, your email platform, your analytics provider, your CRM, your backup service — must be under a written contract meeting Article 28. Most large vendors publish a standard Data Processing Addendum. You are still responsible for having accepted it.
There is an exemption for organisations under 250 employees — but it evaporates if the processing is not occasional, is likely to result in risk, or involves special-category data. Analytics and marketing on a live website is continuous, not occasional. Most small businesses therefore do not qualify for the exemption they assume covers them.
Most UK organisations processing personal data must pay an annual data protection fee to the ICO, on a tiered scale by size and turnover, unless they qualify for an exemption. It is straightforwardly missed by small businesses who have never heard of it. The ICO publishes a self-assessment for determining whether you owe it and how much — use that rather than a figure quoted second-hand.
The moment a visitor's IP address reaches a server outside the UK, you are making a restricted international transfer, and you need a lawful mechanism for it. Since almost every analytics, advertising and font provider is American, this affects nearly every site.
The mechanisms available:
This area has been unstable for a decade — two previous US adequacy arrangements were struck down in court — and it is one where it is genuinely worth checking the current position rather than relying on documentation written a year ago.
Marketing email is governed by PECR, not by GDPR's lawful bases, and the rule is opt-in consent — with one narrow and widely-misapplied exception.
The soft opt-in permits you to email an existing customer about similar products or services, provided you obtained their details in the course of a sale or negotiations for a sale, and you gave them a simple means of opting out at the point of collection and in every message since.
What the soft opt-in does not cover, despite constant claims to the contrary:
And an unsubscribe link is required in every marketing message, unconditionally — including the ones sent under the soft opt-in.
GDPR applies to your website if you process personal data from people in the UK or EU. Personal data includes names, email addresses, IP addresses, and cookie identifiers. If your site has a contact form, uses Google Analytics, has a newsletter signup, or shows personalised ads — GDPR applies. In practice, almost every website with any interactive element is covered.
A compliant cookie consent banner must: appear before any non-essential cookies are set, clearly explain what cookies are used for, provide an equally easy way to reject all cookies as to accept all cookies, not use dark patterns that make rejection harder than acceptance, and record consent so you can prove it was given. Pre-ticked boxes, reject options buried in settings menus, and banners that fire analytics before consent are all non-compliant.
Under UK GDPR, your privacy policy must include: what personal data you collect and why, the legal basis for processing, how long you keep data, who you share it with, whether data is transferred outside the UK/EU, users' rights (access, rectification, erasure, portability), how to complain to the ICO, and contact details for your data controller.
No. Setting a cookie or accessing storage on a user's device is governed by PECR, not by the GDPR lawful bases, and PECR requires consent for anything that is not strictly necessary. Legitimate interests is a GDPR basis for processing personal data and is not available as an alternative to cookie consent. The ICO is explicit that analytics is not strictly necessary, because the user did not request it.
Only those strictly necessary to deliver a service the user has explicitly requested: a shopping basket remembering its contents, a session cookie keeping a logged-in user logged in, security tokens, load balancing, and the cookie that stores the user's own consent preferences. Analytics, advertising, heatmaps and social widgets are not exempt, regardless of whether the data is anonymised.
One month from receipt. This can be extended by up to two further months where the request is complex, but you must tell the individual within the first month that you are extending and explain why. There is no fee unless the request is manifestly unfounded or excessive, and no prescribed format — a request made in an ordinary email is still valid and starts the clock.
They can be. Loading fonts from Google's servers transmits the visitor's IP address to a third party before any consent is given — a German court ruled in 2022 that doing so without consent was unlawful. Self-hosting the fonts removes the issue entirely and is faster. A standard YouTube embed likewise contacts Google and sets cookies on load; use a click-to-load placeholder so nothing is requested until the user chooses to play the video.
Run the GDPR Auditor and get actionable results in minutes. Pay as you go.
Run GDPR Audit →aiwebpageseo.com is a data-driven SEO and AEO (Answer Engine Optimisation) platform providing a free suite of technical website tools. Rather than relying on AI-theorised assumptions, the platform analyses live URL performance, delivering objective diagnostics, page speed metrics, CLS debugging, and site crawl data alongside actionable technical tutorials.