Cookies and GDPR: what a business website needs

Two sets of rules

GDPR covers personal data: a name, an email address, a phone number, and also identifiers that can single out a person, for example in analytics. It applies to every business that collects such data, whatever its size.

Cookies have their own rules, covering information stored in the visitor's browser. They come from the EU ePrivacy rules, implemented in each country: in Poland by the Electronic Communications Law since November 2024, in the UK by PECR, in Ireland by the ePrivacy Regulations. The principle is simple: anything that is not essential for the website to work needs consent.

Which cookies need consent

Cookies are usually split into four groups:

• Essential, such as a basket, a login or remembering the cookie choice itself. No consent needed.
• Analytics, such as Google Analytics. Consent needed.
• Marketing: advertising pixels, remarketing, Google Ads, Meta. Consent needed.
• Third-party content: YouTube videos, maps, chat widgets. They often set their own cookies, so it is worth putting them behind consent too.

A good consent banner

Data protection authorities across Europe, such as UODO in Poland, the ICO in the UK and the DPC in Ireland, look at a few things. A banner is fine when:

• "Reject" is as visible and as easy as "Accept", straight away, not hidden in the settings.
• No consent is ticked in advance, apart from essential cookies.
• Analytics and advertising tools do not start before the visitor decides.
• The visitor can change their mind at any time, for example through a link in the footer.
• The text explains in plain language who collects data and why.

The privacy policy

The privacy policy is the document in which you explain what you do with data. It should include:

• Who the data controller is: the business name, address and contact details.
• What data you collect, for what purpose and on what legal basis.
• Who you share it with, such as your host, email provider or Google.
• How long you keep it.
• The visitor's rights: access, correction, deletion, objection and a complaint to the data protection authority.
• Which cookies the website uses.

The contact form

A form collects personal data, so it should come with a short notice: who the controller is, what the data is used for and a link to the privacy policy. You do not need separate consent to reply to an enquiry, because you are answering the customer's own request.

Consent is needed only when you want to use the data for something more, such as a newsletter. That box must not be ticked in advance or required to send the message.

The most common mistakes

On the websites I check during audits, I most often see:

• Google Analytics or the Meta pixel running from the first visit, before anyone clicks anything.
• A banner with a single "OK" button or with "Reject" hidden in a second window.
• A privacy policy copied from another website, with someone else's details or services the business does not use.
• No way to change the cookie choice once it has been made.

Cookies and Google tools

If you use Google Analytics or Google Ads, the banner alone is not enough. The visitor's choice also has to be passed on to Google's tools, and that is what Consent Mode v2 is for. Without it, Google Ads cannot build remarketing lists from European visits and measures conversions less accurately. I explain it in a separate post on Consent Mode v2.