GDPR for a small website: cookies and privacy

What you'll achieve

• find out which cookies and external services the website uses;
• check that the cookie banner asks for real consent;
• know what your privacy policy and cookie policy should cover;
• know what role your hosting provider plays and where to find the agreement with NBT Host.

The steps

A. Take inventory

1. List every external service on the website: analytics (Google Analytics), ad pixels (Meta, Google Ads, TikTok), embedded maps, YouTube or Vimeo videos, chat, fonts loaded from other servers, external forms, embedded reviews.
2. Open the website in a private window, press F12 (Cmd+Option+I on a Mac) and, before you click anything in the banner, look at Application » Cookies (in Chrome) or Storage » Cookies (in Firefox). Whatever you see there was set without consent.
3. Sort what you found into categories: necessary (the website doesn't work without them: the session, the cart, the banner choice), analytics (statistics) and marketing (ads, pixels).

B. Check the cookie banner

4. Before consent, the website should only have the necessary cookies. Analytics and ads start only after the visitor accepts them.
5. Refusing is as easy as accepting: a “Reject” button next to “Accept”, just as visible, not hidden behind “Settings”.
6. Categories are chosen separately: the visitor can accept analytics and reject ads.
7. Boxes are not pre-ticked, and scrolling the page does not count as consent.
8. The choice can be changed at any time, for example from a “Cookie settings” link in the footer.
9. Test it: reject everything and check the cookies again (step 2). No analytics or marketing cookies should appear.

In WordPress, the banner usually comes from a cookie consent plugin (see The plugins a WordPress website needs). If you use Google Analytics, the banner is connected to Analytics through Consent Mode, which serious plugins support.

C. Check the privacy policy

10. The page is usually called “Privacy Policy” and is linked from the footer of every page. As a rule, it covers:
    • who the controller is: the company name, Tax ID, address and a contact email;
    • what data you collect (from forms, orders, cookies) and why;
    • the legal basis for each (contract, legal obligation, consent, legitimate interest);
    • how long you keep it;
    • who you share it with: your hosting provider, the courier company, your accountant, the external services from your inventory in step 1;
    • whether the data leaves the EU, and with what safeguards;
    • the rights of the data subject (access, rectification, erasure, objection and the others) and how to exercise them;
    • the right to lodge a complaint with ANSPDCP.
11. Make sure it matches what the website actually does. A policy copied from another website, with other services, won't help you.

D. Check the cookie policy

12. It's usually a separate page, linked from the banner and the footer. It says:
    • what cookies are;
    • which categories the website uses and what each one does, specifically;
    • the list of cookies: their name, who sets them (your website or an external service), how long they are kept;
    • how visitors withdraw their consent (the link to the banner settings) and how they delete cookies from their browser.

E. Hosting and the data processing agreement

13. As a hosting company, NBT Host processes the data on your website on your behalf (the website files, databases, emails), which makes it a processor. The terms are in the Data Processing Agreement (DPA), which is part of your contract with NBT Host, along with the Terms and Conditions.
14. The servers are in a data center in the European Union. Mention your hosting provider in your policy, among the recipients of the data.

If something doesn't work

• Analytics cookies appear before consent. The script was added directly in the theme or in another plugin, not through the banner. Remove it from there and let only the banner load it.
• The map or video no longer shows after the visitor rejects cookies. That's the correct behavior: they set cookies. Good banners show a message in their place, such as “Accept marketing cookies to see the map”.
• You don't know which cookie a service sets. Search for the cookie name in the service's documentation; large providers have public lists.
• Someone asked you what data you hold about them. As a rule, the answer is due within one month at most. You can find the data in emails and in the website's database in Enhance and in WordPress; if you need help finding it, write to us.