GDPR for Blogs, Publishers and Content Sites
Blogs, magazines, niche publishers and hobby sites rarely sell anything, so their owners often assume data protection is someone else's problem. Yet a typical content site runs advertising, analytics, video embeds, comments, a newsletter and a contact form, and many also publish information about real people in the articles themselves.
Each of these involves personal data under the UK GDPR, and the cookies and emails are also covered by PECR. This guide works through the parts that are specific to content sites, from ad networks and embeds to comment forms, contributors and requests to remove someone from an article.
Before you start: this is not legal advice
This guide explains how the UK GDPR, the Data Protection Act 2018 and PECR commonly apply to content websites, and suggests practical fixes. It is not legal advice. Publishing information about identifiable people, particularly anything about their health, private life or alleged wrongdoing, raises questions of defamation, privacy and data protection that need proper advice from a media lawyer or data protection specialist. The ICO publishes guidance for organisations, including a code of practice on data protection and journalism.
The Data (Use and Access) Act 2025 is changing some rules in stages, including exemptions from consent for certain low-risk cookies such as some analytics. Check the ICO's current guidance before relying on any exemption, and assume advertising cookies still need consent.
Where personal data flows on a content site
Content sites collect less directly than shops, but they pass a lot to third parties because of advertising and embedded media. A quick map helps you see the whole picture.
| Feature | Data involved | Who receives it | Usual rule |
|---|---|---|---|
| Display advertising | Cookie and device identifiers, IP address, browsing behaviour | Ad network and its many partners | Consent under PECR before non-essential cookies; consent is the natural UK GDPR basis too |
| Analytics | Cookie identifiers, pages viewed, approximate location | Analytics provider | Consent unless a current exemption genuinely applies |
| Video and social embeds | IP address, cookies set by the platform | The video or social platform | Consent before the embed sets non-essential cookies |
| Comments | Name, email, website, IP address, the comment itself | You, plus spam and avatar services if used | Legitimate interests is common, with a clear notice |
| Newsletter | Email address, name, open and click data | Email platform | Consent under PECR for marketing emails |
| Contact form | Name, email, message | You and the form or email provider | Legitimate interests to reply |
| Article content | Information about people named or pictured | Everyone who reads it | Needs a lawful basis; special purposes exemption may be relevant |
Advertising and ad networks
Advertising is usually the biggest data flow on a content site and the one visitors notice most. Programmatic ads involve your ad network, and often many other companies, receiving identifiers and bidding on each page view.
- Use a consent platform your ad network supports. Google requires publishers using its advertising products to serve ads to users in the UK, the EEA and Switzerland to use a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. Other networks set similar conditions. Check your network's current requirements in its help pages.
- Give a real choice. Visitors must be able to refuse advertising cookies as easily as accept them. Many publishers offer non-personalised or limited ads to those who refuse, which your consent platform and ad network can usually handle.
- Do not load ad tags early. The ad script should read the consent signal before it sets cookies or requests personalised ads. Test in a private window: before you answer the banner, there should be no advertising cookies.
- "Consent or pay" models. Some publishers offer an ad-free subscription as the alternative to accepting tracking. The ICO has published views on when this can be fair, including a reasonable price and a real choice. Read that guidance before adopting such a model.
The detailed mechanics of banners are covered in fixing cookie consent banners, and making scripts wait is covered in fixing tracking before consent.
Video and social embeds without tracking
An embedded video or social post loads content from the platform's servers as soon as the page opens, which sends the visitor's IP address and may set cookies before any consent. A click-to-load placeholder solves this: show a thumbnail and a short message, and only load the real embed when the visitor chooses to play it.
<div class="video-embed" data-src="https://www.youtube-nocookie.com/embed/VIDEO_ID">
<img src="/images/video-thumb-harbour-walk.jpg" alt="Walking the harbour wall at low tide" width="640" height="360">
<p>This video is hosted by YouTube. Playing it loads content from YouTube,
which may set cookies. <a href="/privacy#embeds">Read more</a></p>
<button type="button" class="video-load">Load and play video</button>
</div>A few lines of JavaScript replace the placeholder with the iframe when the button is pressed, or automatically if the visitor has already consented to that category in your consent platform. Host the thumbnail yourself, because loading it from the platform would send a request before the choice.
The fix, step by step
Step 1
Inventory what your pages load and collect
Open a typical article, the home page and a page with a video in a private browser window with the developer tools open. Record every third-party domain in the Network tab and every cookie set before you touch the banner. Then list every form on the site, including comments, newsletter boxes, contact forms and guest post submissions, and note what each collects, where it is stored and which service sends or holds it.
Step 2
Put ads, analytics and embeds behind consent
Configure your consent platform so that advertising, analytics and embedded media are separate categories that start switched off. Make sure ad tags read the consent signal before loading personalised ads, and replace video, map and social embeds with click-to-load placeholders. Test again in a private window: before a choice, no advertising or analytics cookies should appear, and after refusing, only non-personalised options your network supports should load.
Step 3
Trim the comment form to what it needs
Decide whether you need the website field and whether email must be required. Add a short notice under the form explaining what is stored, why, and for how long, linking to the privacy notice. If you use an avatar service or a spam-checking service, mention that comment data or an email hash is sent to it. Set a period after which IP addresses stored with comments are removed, since they are rarely needed once spam checks are done.
Step 4
Build the newsletter on clear consent
Use an unticked checkbox or a dedicated sign-up form that says what readers will receive and how often, with a link to the privacy notice. Turn on double opt-in in your email platform so each address is confirmed by its owner, which also gives you a record of consent. Put an unsubscribe link in every email, honour it promptly, and do not add commenters or people who contacted you to the list without asking.
Step 5
Handle contributor and author data
Author bios, photos, social links and payment details for freelance writers are personal data too. Agree with each contributor what will be published about them and for how long, keep payment and tax details separately from the public profile, and decide what happens to their author page if they stop writing for you. Keep guest post submissions and pitches only as long as you need them, and delete rejected ones on a schedule.
Step 6
Set a policy for removal requests about articles
Write a short internal policy for requests from people who appear in your articles and want their name, photo or story removed. Treat each as a possible erasure request or objection with a one-month deadline, weigh the public interest in the content against the effect on the person, and consider options short of deletion, such as anonymising a name or updating an outdated article. Record each request and your reasoning.
Step 7
Publish a privacy notice that matches the site
Rewrite the privacy notice from your inventory rather than a template, covering advertising partners, analytics, embeds, comments, the newsletter, the contact form and contributors, each with its purpose, lawful basis and retention period. Explain how readers can change cookie choices later and how to ask about their data. Run the GDPR Audit afterwards and compare its findings with the notice to confirm nothing is missing.
WordPress specifics
Many content sites run on WordPress, and a few of its defaults are worth knowing.
- Comments store more than you see. WordPress saves the commenter's IP address and browser user agent with each comment by default. A privacy or maintenance plugin, or a small scheduled task, can remove these after a set period.
- Comment cookies checkbox. Core WordPress offers an optional checkbox for saving the commenter's name, email and website in a cookie for next time. Leave it unticked by default, as it is.
- Avatars. By default WordPress shows avatars from Gravatar, which involves sending a hash of the commenter's email address to that service. You can switch avatars off under Settings, Discussion, if you do not need them.
- Privacy tools. Under Tools, WordPress includes export and erase personal data features that search data stored by core and by plugins that support them. They help with comment authors' requests but do not reach data in external services.
- Privacy policy guide. Settings, Privacy includes suggested text from core and some plugins. Use it as a prompt, not a finished policy.
- Plugins that phone home. Social sharing, related posts and statistics plugins sometimes load third-party scripts or send data to their developer. Check each one against your inventory.
Articles about real people
Content sites differ from most businesses because the product itself can contain personal data. A local news story, a review naming a business owner, a photo from an event or a feature about a community figure all involve information about identifiable people, and the UK GDPR applies to publishing it.
The Data Protection Act 2018 contains an exemption for the special purposes, which are journalism, academic, artistic and literary purposes. In broad terms it can disapply some provisions, including some individual rights, where the processing is for publication, the controller reasonably believes publication is in the public interest, and applying the provision would be incompatible with the special purpose. It is not a blanket exemption for anything published online, and whether it applies depends on the facts. The ICO's code of practice on data protection and journalism explains how it sees the exemption working.
Practical habits help regardless of the exemption: publish only the personal detail the story needs, take extra care with children and with sensitive information such as health, correct inaccuracies quickly, and review old articles about private individuals when asked, particularly where the story is minor and many years old.
1. Does GDPR apply to a personal blog?
It depends on what the blog does. Processing purely for personal or household activities falls outside the UK GDPR, but most blogs that run advertising, affiliate links, a newsletter, analytics or comments open to the public are likely to go beyond that. Once the blog is run as a business or even a side income, assume the rules apply: you need valid cookie consent, a privacy notice, a lawful basis for each purpose and a way to handle requests.
2. Do I need consent to show ads on my blog?
For personalised advertising, which relies on cookies and similar technologies to track visitors, PECR requires consent before those cookies are set, and consent is the natural basis for the related processing. Ad networks commonly require a supported consent platform, and Google requires a certified platform integrated with the IAB framework for UK and EEA traffic. Many networks can serve non-personalised or limited ads to visitors who refuse, so refusing need not mean no revenue.
3. Is it enough to use youtube-nocookie.com for embedded videos?
It helps but is usually not enough on its own. Privacy-enhanced mode reduces what YouTube stores before a visitor plays the video, but loading the embed still sends a request to Google's servers with the visitor's IP address. A click-to-load placeholder with a self-hosted thumbnail, or loading the embed only after consent to that category, is the more reliable approach. Mention embedded content and its provider in your privacy notice.
4. What should a blog comment form say about privacy?
A short notice under the form should explain what you store, such as name, email and the comment, why you store it, which is usually to display and moderate comments and prevent spam, whether any service such as a spam filter or avatar provider receives the data, and how long you keep it. Link to the full privacy notice. Only make fields required if you genuinely need them, and never add commenters to a mailing list.
5. Do I need double opt-in for a newsletter?
Double opt-in is not a legal requirement in the UK, but it is good practice. PECR generally requires consent before sending marketing emails to individuals, and you must be able to show that consent was given. Double opt-in confirms the address belongs to the person who signed up, prevents others signing people up without their knowledge, and gives you a timestamped record of the confirmation, which is useful evidence if a complaint arrives.
6. Someone wants their name removed from an old article. Do I have to?
Not automatically, but you must take the request seriously and respond within one month. Treat it as a possible erasure request or objection, and weigh the public interest in the article against the effect on the person, considering how old and significant the story is. The special purposes exemption may apply to journalism in some cases. Options include anonymising the name, updating the article or adding context. Record your decision and reasons.
7. Are guest authors' bios personal data?
Yes. A contributor's name, photo, biography, social media links and any payment or tax details are personal data. Agree with each contributor what you will publish and how long it will stay, keep financial details private and separately stored, and tell them how to ask for changes. When someone stops contributing, decide whether their author page and bio stay with their articles or are reduced, and be ready to explain that choice if asked.
The GDPR Audit checks what a visitor can see: the cookie banner, ad and analytics scripts that load before consent, the privacy policy and the routes readers have to exercise their rights, with a guide for each finding.
Open GDPR Fixes →