Is my website GDPR compliant? Use this GDPR website checklist: a site is likely to meet GDPR and the UK’s cookie rules if it does four things: asks for consent before setting non-essential cookies and actually waits for it, collects only the personal data it needs through forms, explains what it does with that data in a clear privacy notice, and uses third-party tools that handle data properly. Most problems we see are not missing documents but tracking scripts that run before anyone clicks “accept”.
This checklist covers what to check on a business website. We build websites; we are not lawyers. For decisions about your obligations, ask a qualified adviser.
Who this applies to
The EU GDPR applies when you offer goods or services to people in the EU or monitor their behaviour, wherever your business is based. The UK has its own version, UK GDPR, alongside PECR, the UK’s rules on cookies and electronic marketing. EU countries apply the ePrivacy Directive for cookies. If your site has visitors from the UK or EU and uses analytics, ads or forms, this checklist is relevant.
1. Cookies and tracking
- List every cookie and tracker the site sets. Open the site in a private window, then check the browser’s storage and network list. Include analytics, ad pixels, chat widgets, video embeds and fonts loaded from other servers.
- Sort them into essential and non-essential. Essential means needed for the site to work as the visitor asked, such as a shopping cart or a login. Analytics and advertising are not essential.
- No non-essential cookies before consent. Test it: load the site fresh, don’t click the banner, and check whether analytics or ad scripts have already loaded. This is the most common failure.
- Reject is as easy as accept. A “Reject all” button at the same level as “Accept all”. The ICO and EU regulators have both said consent must be as easy to refuse as to give.
- No pre-ticked boxes. Optional categories start switched off.
- Visitors can change their mind later, through a link in the footer that reopens the settings.
- Consent is recorded, so you can show when and what a visitor agreed to.
On our own site, analytics loads only after a visitor turns on the statistics category, and the choice can be changed at any time from the footer. That is the behaviour to test for.
2. Forms
- Collect only what you need. A contact form rarely needs a date of birth or a home address.
- Say what happens to the data next to the form, with a link to the privacy notice.
- Marketing sign-up is separate and optional. A contact form can’t double as newsletter consent.
- Form data goes somewhere safe. Check where submissions are stored: your inbox, the CMS database, a CRM. Delete old entries you no longer need.
- The site uses HTTPS on every page, so form data is encrypted in transit.
3. Privacy notice
- Who you are and how to contact you about data
- What data you collect through the site, including cookies, forms and analytics
- Why, and the lawful basis for each purpose
- Who you share it with: hosting, analytics, email and CRM providers
- International transfers, if providers store data outside the UK or EU
- How long you keep it
- Visitors’ rights: access, correction, deletion, objection, and how to complain to the regulator
- Linked from every page, usually in the footer
4. Third-party tools and embeds
- YouTube and Vimeo embeds: use privacy-enhanced modes, or load the video only after a click or consent
- Maps: a static image with a link, or load the map after consent
- Fonts: host web fonts on your own server rather than loading them from a third party
- Chat widgets and social buttons: load them after consent if they set cookies
- Data processing agreements with providers that handle personal data for you; most offer them as standard terms
A five-minute GDPR website checklist test
- Open your site in a private window
- Don’t touch the banner
- Open the browser’s developer tools and check the network list and stored cookies
- If you see analytics, ad or social requests, tracking is running before consent
- Click “Reject all”, reload, and check again
If tracking still runs after rejecting, the banner is decoration, and that needs fixing first.
Questions people ask
Do I need a cookie banner if I only use Google Analytics? Under UK and EU rules, analytics cookies generally need consent, so yes, unless you use an analytics setup that doesn’t use cookies or identify visitors. Check the current guidance from the ICO or your national regulator.
Is a cookie banner plugin enough? Only if it blocks scripts until consent. Many plugins show a banner but don’t connect to the scripts. Test it with the steps above.
Does GDPR apply to a US business? It can, if you target customers in the UK or EU. Ask an adviser about your situation.
We set up consent that blocks tracking until a visitor agrees on every site we build for UK and EU audiences; see web design for UK businesses. For the rest of the technical basics, run our technical SEO checklist and accessibility checklist.