GDPR for Small Business Websites: What You Actually Need
Do you really need that cookie banner? Here is how to find out in three questions, plus the steps to get your site compliant without hiring a lawyer.
A pottery studio owner asks: "My website is just five pages and a contact form. Do I seriously need one of those cookie pop-ups?" It is one of the most common questions small business owners have about their site, and most answers online are written by companies selling compliance software, so everything sounds mandatory.
Here is the honest version: what the rules actually require depends on two things only. What your website collects, and where your visitors are. Some small business sites genuinely need a cookie banner. Many do not. Almost every site needs a privacy policy. This guide walks you through figuring out which group you are in, then fixing what needs fixing, in about an afternoon.
One note before we start: this is practical guidance, not legal advice. If you handle sensitive data (health, finance, kids) or operate at scale, talk to a professional.
The three questions that decide everything
Privacy rules like the EU's GDPR and the UK's version of it follow your visitors, not your address. A bakery in Ohio with EU visitors is technically in scope; in practice, regulators focus on businesses that target EU customers, not ones that occasionally get a stray visitor. US state laws (California, Colorado, and others) mostly require clear notice and an opt-out rather than an EU-style consent pop-up. So instead of memorizing laws, answer three questions about your own site:
Step 1: Audit what your site actually collects (10 minutes)
Do not guess. Your website builder, theme, or that analytics snippet you added in 2023 may be setting cookies you forgot about. Here is the check:
Open your site in Chrome in a fresh incognito window.
Press F12 to open DevTools, click the Application tab, then Cookies in the left sidebar.
Click your domain and read the list. Cookies starting with
_gaare Google Analytics._fbpis the Meta (Facebook) Pixel._ttpis TikTok. Anything from ad platforms counts as non-essential tracking.Also list every form on your site and what it asks for: name, email, phone, anything else.
We ran this exact check on our own site while writing this post. storypress.app sets five cookies: two for Google Analytics (_ga, _ga_R3MS2TD656), one Meta Pixel cookie (_fbp), one login session cookie, and one that stores your consent choice. Two of those five are ad/analytics trackers, which is precisely why our site runs a consent banner. That is the test: trackers present means banner needed.
How to verify it worked: you can answer, in one sentence, exactly which trackers your site runs and what personal data your forms collect. If you cannot, repeat the audit.
Step 2: Publish a privacy policy that says something true
Under GDPR Article 13, a privacy policy has a short mandatory list. In plain English, yours must state:
What you collect: "Our contact form collects your name, email address, and message."
Why: "We use it to reply to your enquiry."
How long you keep it: "We delete enquiry emails after 12 months."
Who else sees it: name your tools. "Form submissions are processed by our website platform; analytics data goes to Google."
Visitors' rights: they can ask to see, correct, or delete their data, and how to contact you to do it.
Write it yourself in the same plain language, one honest paragraph per bullet beats ten pages of copied legalese naming tools you do not use. Link it in your site footer so it is reachable from every page. The UK regulator's advice hub for small organisations is a genuinely readable reference if you want to go deeper.
How to verify it worked: open your policy and check every named tool actually runs on your site, and every tool from your Step 1 audit is named in the policy. The two lists should match.
Step 3: Add a cookie banner only if Step 1 says so
If your audit found analytics or ad cookies and you serve EU/UK visitors, you need a consent banner. But most banners on the internet are non-compliant decoration. Per GDPR cookie guidance, a valid banner must actually block non-essential cookies until the visitor says yes, and rejecting must be as easy as accepting. Free tiers of tools like CookieYes, Cookiebot, or Termly handle the blocking for you; hand-rolled "we use cookies, OK?" notices do not.
A banner done right
Accept and Reject buttons side by side, equal size
Trackers stay OFF until Accept is clicked
Links to your cookie/privacy policy
Choice is remembered; visitors can change it later
A banner done wrong
Only an OK button; Reject hidden behind Settings
Trackers fire before anyone clicks anything
Pre-ticked consent boxes (explicitly invalid)
Banner on a site with zero trackers: pure friction
How to verify it worked: redo the Step 1 cookie check in a fresh incognito window, but this time click Reject. If _ga or _fbp cookies still appear, your banner is decorative and the blocking is not wired up.
Step 4: Clean up your forms
Forms are where small sites most often slip. Three fixes, five minutes each:
Cut fields you do not need. Every field is data you are responsible for. If you never call people, drop the phone field. Bonus: shorter forms get more submissions.
Never pre-tick the newsletter box. Consent must be a real choice. A contact form that silently subscribes people to marketing is the classic violation.
Add one line under the button: "We use your details to reply to your message. See our privacy policy." Purpose stated, link provided, done.
Cheat sheet: what your site needs
| Your situation | Privacy policy | Cookie banner |
|---|---|---|
| Brochure site, no forms, no analytics | Smart to have | No |
| Contact form, no analytics | Yes | No |
| Analytics or ad pixels, EU/UK visitors | Yes | Yes, with real blocking |
| Selling or marketing to EU/UK customers | Yes, full GDPR | Yes, with real blocking |
“Compliance is not the pop-up. It is being able to say, truthfully and in one breath, what your site collects and why.”
The good news about keeping it simple
Notice the pattern in the flowchart: every obligation follows from what you chose to load onto your site. The fewer trackers and plugins your site carries, the shorter your compliance list gets. That simplicity is partly why we built StoryPress the way we did: a $5/month site with no plugin pile to audit, and when a customer needs a privacy policy page, they can literally ask Claude to draft one and add it to the footer through the built-in MCP connection.
Whatever platform you are on, the afternoon checklist is the same: audit your cookies, publish an honest policy, add a banner only if the audit demands one, and trim your forms. Then it is done, and you can get back to running your business.
One practical website guide like this, every week
Where We're Going, We Don't Need Plugins: The Vision for StoryPress
For over a decade, building a website has forced people into a frustrating compromise. Whether you're scaling a small business or building a professional portfolio, you typically face a stark choice: DIY & AI slop, or pay thousands for the dev stack. We looked at this divide and realized something fundamental had to change.