Most of the websites I check are not non-compliant because their owners don't care. They are non-compliant because the law arrived last. The design was approved, the developer built it, the site went live — and then someone remembered the cookie banner and pasted one on top.
That order is the problem. By the time the banner arrives, the fonts are already loading from a server in another country, the map is already setting cookies, the analytics script is already firing before anyone has clicked anything. The banner becomes a decoration placed over decisions that were made without it.
A website is not a brochure with a privacy policy attached. Every element on it is a decision about someone else's data.
Every element is a legal decision
When you build a website, you are not only choosing how it looks. You are choosing which companies receive your visitors' data, when and on what legal basis. A few ordinary examples:
- Web fonts. Loading fonts directly from a third-party server sends each visitor's IP address to that provider. In 2022 a German court (LG München I) awarded a visitor damages for exactly this. Hosting the fonts yourself costs nothing and removes the issue.
- Embedded videos and maps. A YouTube video or Google Map can set cookies and contact external servers the moment the page loads. A simple "click to load" placeholder solves it.
- Analytics. Tracking tools that store identifiers on the device generally need consent first. Privacy-friendly, cookieless setups often don't — that is a design choice, not a legal technicality.
- Contact forms. Every form is a collection point for personal data. Who receives the submissions, where are they stored, for how long?
- Chat widgets, newsletter tools, booking systems. Each one is usually a processor that needs a contract (Article 28 GDPR) and a line in your privacy notice.
None of this is exotic. It is the normal anatomy of a business website. That is exactly why legal knowledge belongs in the brief, next to the colour palette and the sitemap.
What the law actually asks
Stripped of jargon, the rules for a typical business website come down to a handful of principles:
- Consent before non-essential cookies. Under the ePrivacy rules (Article 5(3) of the ePrivacy Directive, implemented nationally — in Germany by § 25 TDDDG), storing or reading information on a visitor's device requires consent unless it is strictly necessary for the service they asked for.
- Real consent, not a trick. The Court of Justice of the EU ruled in Planet49 (2019) that pre-ticked boxes are not valid consent. European regulators expect "reject" to be as easy as "accept".
- A legal basis for every processing. Article 6 GDPR: consent, contract, legal obligation, legitimate interest — you need one, and you need to know which.
- Transparency. Article 13 GDPR: tell people, in plain language, what you collect, why, who receives it and how long you keep it.
- Privacy by design and by default. Article 25 GDPR literally requires data protection to be built into the system from the start. The law itself says: design first, not patch later.
- Care with transfers outside the EU. Many tools send data to the US. The EU–US Data Privacy Framework (since July 2023) covers certified companies, but you still need to know which tools you use and on what basis.
Why retrofitting costs more
The headline risk is the GDPR fine: up to €20 million or 4% of worldwide annual turnover. For a small business, that is rarely the realistic threat. The realistic threats are smaller and more frequent:
- warning letters from competitors or associations — common in Germany and Austria;
- claims for non-material damages from visitors under Article 82 GDPR;
- complaints to the data protection authority, which then asks questions you must answer;
- and the quiet cost: rebuilding parts of a site that could have been built correctly the first time.
Replacing an embedded map, re-hosting fonts, rewiring analytics and rewriting the privacy notice after launch takes longer than doing it during the build. Legal knowledge, applied early, is simply cheaper.
What is changing — and what is not
In November 2025 the European Commission proposed a "Digital Omnibus" that would, among other things, move cookie rules into the GDPR and introduce some exemptions, for example for certain audience measurement. As of October 2026 this part is still a draft: the Council has not agreed its negotiating position, and nothing has been adopted.
The practical rule is simple: build for the law in force, not for a proposal. The current consent rules apply today. If the rules change, a site that was designed with clean consent logic is also the easiest one to adjust.
A short checklist for your next website
- List every third-party service the site will load — before design is approved.
- Host fonts and essential scripts yourself where you can.
- Put videos, maps and social embeds behind a click-to-load placeholder.
- Block non-essential cookies until consent; make "reject" as visible as "accept".
- Sign processor agreements with form, hosting, newsletter and chat providers.
- Write the privacy notice from the actual setup — not from a template.
The point
Law is not the enemy of good design. Clean, fast websites that load only what they need tend to be both more compliant and more pleasant to use. The best time to think about GDPR is when you are still deciding what the site will be. After that, you are no longer designing — you are repairing.
Want to know where your current website stands? Our free GDPR & cookie check shows what loads, what sets cookies and what needs fixing — and for €99 we fix it for you.
Lawyer by training, web builder by trade. Goran writes about EU digital law — GDPR, the DSA and the AI Act — and what it means for the people who build and run websites.
Sources
This article is general information, not legal advice. It reflects the law as of its publication date.