Cookie Banners and GDPR: The Legal Basics in Plain English

Privacy law occupies a strange place in the small-business mind: vaguely threatening, entirely unread. You know GDPR exists. You know cookie banners are everywhere. You suspect your site should be doing something it isn't, and you've decided not to look too closely, because the last time you tried, the explanation was written by lawyers for lawyers. Here's the version written for someone with a business to run. The usual caveat applies: this is orientation, not legal advice.

The core idea is genuinely simple

Strip the acronyms and privacy law says one thing: if you collect information about people, you owe them honesty about it. What you collect, why, who else sees it, how long you keep it. Everything else — banners, policies, consent checkboxes — is machinery for delivering that honesty. A small-business website typically touches personal data in only a few places: a contact form, a booking system, a newsletter signup, and analytics. That's the whole battlefield. You are not Google, and the law doesn't expect you to behave like Google.

What you actually need

• A privacy page in human language: what you collect through forms and tools, why, and how someone can ask you to delete their data. One honest page beats ten borrowed ones.
• A cookie banner only if you set non-essential cookies — analytics and marketing pixels being the usual culprits. Essential cookies that make the site function don't need consent.
• A real choice on that banner. 'Accept or accept' isn't consent. Declining must be as easy as accepting, and analytics should stay off until someone says yes.
• Forms that ask for what you need and nothing more. Every extra field is data you're now responsible for.
• The padlock — HTTPS. Table stakes for both trust and the law's expectation that you protect what you collect.

The myths that waste your worry

Myth one: 'GDPR doesn't apply to businesses my size.' It applies to anyone handling EU or UK personal data — but proportionately; a café's obligations are a café's, not a bank's. Myth two: 'a copied privacy policy covers me.' A policy describing tools you don't use, while missing ones you do, documents your non-compliance rather than fixing it. Myth three: 'no banner means I'm breaking the law.' If you don't set non-essential cookies, no banner is required — plenty of well-built sites are banner-free because they were built to need less consent, which is the most elegant compliance there is.

Compliance by construction

The expensive way to handle privacy is retrofitting: bolting banners and policies onto a site that was built collecting first and asking questions later. The cheap way is building it in: collect the minimum, load nothing non-essential before consent, serve everything over HTTPS, and write the privacy page as part of the site's actual copy. That's how our pipeline builds — the privacy layer is part of the architecture, not a plugin bolted on when someone remembers. AI does most of the work. Paul reviews everything before it ships.

One evening with the list above puts you ahead of most of your competitors. Not because the regulator is coming for the bakery — but because 'we take your data seriously, here's exactly how' is a trust signal your customers can feel, whether or not they ever read the page.