GDPR compliant website: what it needs, with our own setup as the example

How do you make your website GDPR compliant? Six things: a privacy notice that says what you collect and why, consent before any non-essential cookie or tracker, forms that ask only what you need, a processing agreement with every provider that handles personal data for you, security that fits the risk, and a plan for where data goes outside the EU. A cookie banner alone is one of the six, not the whole job.

This guide is for a business anywhere that runs a website seen by people in the EU or the UK. It goes through each requirement, answers the Google Analytics question here rather than on a separate page, and uses our own site as the worked example: vbsmarketing.eu measures visitors without cookies and without sending anything to a third party. It is the technical side; for advice on your own situation, talk to a lawyer.

The six things a GDPR compliant website needs

Fines run up to 20 million euro or 4% of worldwide turnover, whichever is higher, but the everyday risk for a small business is a complaint to the data protection authority, a formal order and the time it costs to answer it.

Example of a GDPR compliant website: ours

The site you are reading is a static export on Amazon S3 behind CloudFront. There is no database on the web server and no plugin to keep up to date. Three flows touch personal data or could:

1. The visit. A small function on AWS (Lambda) counts the page, the source and any campaign code, and writes it to a database (DynamoDB) in Stockholm, inside the EU. It sets no cookie and reads nothing from the device, so there is nothing to ask consent for and nothing sent to Google or Meta.
2. The contact form. A submitted form goes to our own function on AWS, which filters out bots and sends the message by email through Amazon SES. We ask a name, an email address, optionally a phone number, and the message. The same form service runs the contact forms of eleven client domains.
3. The fonts and images. Served from our own domain, so no request leaves for a font service when the page loads.

That is why our privacy statement can be short, and why there is no cookie banner on this site. It is a design choice with a price: we see fewer details than Google Analytics would give us, and we cannot build advertising audiences from our visitors. For most small business sites that trade-off is worth it; for a site that advertises heavily, it may not be.

Is Google Analytics GDPR compliant?

It can be, with conditions. In 2022 the Austrian, French and Italian authorities ruled that specific uses of Google Analytics broke the GDPR, because personal data went to the United States without adequate protection. On 10 July 2023 the European Commission adopted the EU-US Data Privacy Framework, which covers transfers to certified US companies, Google among them. Since then the transfer question is settled for most uses, as long as that framework stands.

What remains is consent. Analytics sets cookies and processes personal data, so in the EU and the UK it needs a yes from the visitor first. Consent Mode does not remove that need: it is the mechanism that tells Google tags whether the visitor said yes, and in its advanced setting it sends cookieless pings when the answer is no. Since 15 June 2026 Google Ads takes its data from Analytics through consent mode only; see the consent mode change. The full setup is in Google Analytics 4 setup.

Server-side tagging is often sold as a way around the banner. It is not; server side tracking explains why.

GDPR compliant website analytics without cookies

If all you need is how many people visit, where they come from and how many send an enquiry, measurement without cookies does the job and keeps the banner off your site. The condition is that nothing is stored on or read from the visitor's device, and no identifier follows a person across visits. That is what our own setup does, and the Business Centrum site measures the same way. Whether you need a banner at all is set out in do I need a cookie banner.

Forms, email and the providers behind them

Every form on your site sends personal data somewhere: a mailbox, a CRM, a newsletter tool. Each of those providers processes data for you and needs a data processing agreement; most offer one in their terms. Ask only what you need, say in one line next to the form what you do with it, and keep a list of where the data ends up. A form that leaks spam or gets abused is also a security problem; stop contact form spam covers the filters.

GDPR compliant web hosting

GDPR does not require hosting inside the EU, but it does require you to know where data goes and on what basis. Hosting with a European provider, or with a US provider in an EU region, keeps the question simple. Our sites run on AWS in EU regions, with the measurement database in Stockholm. Security matters as much as location: HTTPS with a valid SSL certificate, updates, two factor authentication on every admin account, and a plan for when things go wrong. A breach involving personal data must be reported within 72 hours; what to do when your website is hacked has the hour-by-hour plan.

Your privacy notice, and what is changing

The notice is where the six things come together: who is responsible, what you collect, why and on which basis, how long you keep it, who receives it, where it goes outside the EU, and how visitors exercise their rights. Whether you need one, and what goes in it, is in do I need a privacy policy. EU rules on cookies may ease for some low-risk purposes; the state of that debate is in the Digital Omnibus on cookies and the GDPR. Until it becomes law, today's rules apply.