What Website Compliance Pages Do You Actually Need? (GDPR, Privacy Policy, Cookies, and More)

Compliance pages are not the exciting part of building a website.

But they are part of running a responsible business.

And getting them wrong carries real legal and reputational risk, not just an awkward footer link.

If your website uses contact forms, analytics, email signups, or appointment tools — which covers almost every service business website — this guide explains what you actually need, why it matters, and how to set it up properly without becoming a legal expert yourself.

Does GDPR actually apply to your website?

Yes, if you process the personal data of anyone in the EU — regardless of where your business is located.

GDPR (General Data Protection Regulation) applies to any business operating in the EU, or offering goods and services to, or monitoring the behaviour of, people in the EU.

For a service business based in Italy, Spain, or elsewhere in Europe, this is not optional — it applies in full.

“Personal data” is broader than most people assume.

It includes names, email addresses, IP addresses, and even data collected automatically through analytics or advertising cookies.

What does GDPR actually require, practically speaking?

For a typical business website, the practical requirements come down to:

• A lawful basis for collecting any personal data (usually consent, or “legitimate interest” for some cases)
• Clear, specific consent before placing non-essential cookies — pre-ticked boxes or implied consent are not valid
• A privacy policy explaining what data you collect, why, and how it’s used
• The ability for people to access, correct, or delete their data on request
• Secure handling of any data you store

What compliance pages does a service business website need?

A privacy policy — always

This explains what personal data you collect, why, how long you keep it, and who it might be shared with (email providers, booking tools, analytics services).

This is needed for essentially every business website — even a simple one with just a contact form.

A cookie policy and consent banner — usually

If your site uses analytics (Google Analytics), embedded content (YouTube videos, Google Maps), marketing pixels, or similar tools, you need a cookie consent mechanism that:

• Blocks non-essential cookies until the visitor consents
• Lets visitors choose per-category (functional, statistics, marketing) rather than only an all-or-nothing choice
• Keeps a record that consent was actually given

A banner that only informs visitors cookies are being used, without actually blocking them until consent, does not meet GDPR requirements — this is one of the most common mistakes on small business websites.

Terms of service — recommended, sometimes required

Useful for setting expectations around your services, payment terms, and liability.

Not always a strict legal requirement, but strongly recommended, particularly if you sell services, take payments, or operate a booking system directly through your website.

Other pages depending on your business

• Accessibility statement — increasingly expected, sometimes legally required depending on jurisdiction and business size
• Professional disclosures — relevant for regulated professions, such as registration details for psychologists and therapists
• Refund or cancellation policy — relevant if you sell services, courses, or products directly

What actually triggers these requirements?

Almost any normal business website function:

• A contact form — collecting name and email already counts as processing personal data
• Analytics tools (Google Analytics, Hotjar, etc.) — typically require consent before tracking
• Email signup forms — need clear, explicit consent, and a transparent explanation of what subscribers will receive
• Booking or scheduling tools — whether a contact form or a direct booking calendar, both involve collecting and storing personal data
• Embedded maps, videos, or social media widgets — these often set third-party cookies before a visitor has consented, which is itself a compliance gap many site owners don’t realise exists

How do you actually set this up on WordPress?

Using a dedicated plugin — the practical approach

Complianz is the plugin I use and recommend for WordPress sites.

Its free version includes:

• A GDPR and CCPA-compliant cookie consent banner
• Automatic cookie scanning to detect what your site actually uses
• Script and iframe blocking until consent is given
• A privacy policy generator, built through a guided wizard

Premium (from $59/year for one site) adds:

• Records of Consent (a legal requirement for proving consent was given)
• Geo-IP detection (showing the right banner based on visitor location)
• Google Consent Mode v2 integration
• and A/B testing for the banner itself

CookieYes is a solid comparable alternative, with a similar free/paid structure and broadly equivalent features — either is a reasonable choice, and the right one often comes down to which interface you find easier to configure.

What a plugin does not do for you

A plugin handles the technical mechanism — it does not replace understanding your own data practices.

You still need to know what forms, tools, and third-party services your site actually uses, so the generated policy accurately reflects reality rather than a generic template.

This is exactly why copying privacy policy text from another website is a common mistake: it describes someone else’s data practices, not yours, and inaccurate disclosure can itself be a compliance problem.

What if you serve clients outside the EU too?

If you serve US clients, be aware that several US states (California’s CCPA/CPRA being the most prominent) have their own privacy laws with broadly similar requirements — consent, disclosure, the right to deletion — though the specifics differ from GDPR.

Complianz and CookieYes both support CCPA alongside GDPR, which covers most small businesses serving a mixed international audience without needing separate tools.

If you’re unsure which regulations actually apply to your specific business and client base, this is worth a short conversation with a legal professional.

The plugin can handle the technical implementation, but it cannot tell you which laws apply to your situation.

Common mistakes worth avoiding

• Copying policy text from another website — it describes their practices, not yours
• A cookie banner that only informs, without actually blocking non-essential cookies until consent
• Forgetting about third-party embeds — Google Maps, YouTube, and social widgets often set cookies before consent is given
• Never updating the policy as your tools and services change — if you add a new booking system or email platform, your privacy policy should reflect it
• Treating this as a one-time task — compliance pages need periodic review, similar to other aspects of ongoing site maintenance

—

Are your compliance pages protecting your business — or just sitting there?

These pages are not exciting, but they are part of running a credible, responsible business online — and getting them wrong carries real risk.

At SR Web Marketing, I set up WordPress websites for independent professionals and local businesses across Abruzzo, Pescara, and remotely across Italy, Spain, and Europe with the correct compliance foundation in place from the start — not bolted on as an afterthought.

If you’re not sure whether your current website is properly compliant, get in touch for a free initial conversation.

—

Frequently asked questions

Does a simple 5-page website really need a privacy policy?

Yes, if it collects any personal data at all — which includes almost every contact form, even one asking only for a name and email. The complexity of the policy can scale with how much data you actually collect, but the requirement to disclose your data practices applies regardless of how simple the site is.

Is a free cookie consent plugin like Complianz actually enough?

For many small business websites, yes — the free version of Complianz covers the cookie banner, scanning, script blocking, and a basic privacy policy generator, which handles the core requirements. Premium becomes worthwhile specifically if you need Records of Consent (proof that consent was given, which can matter in a dispute) or Google Consent Mode v2 for advertising integrations.

What happens if my website isn’t GDPR compliant?

Penalties can be significant — GDPR fines can reach up to €20 million or 4% of global annual turnover for serious violations, though enforcement against small businesses for minor or first-time issues is typically less severe and often starts with a warning or correction request rather than an immediate fine. Beyond the legal risk, a visibly non-compliant site (a cookie banner that doesn’t actually work, no privacy policy at all) can also damage trust with visitors who notice.

Do I need a different approach if I serve clients in both the EU and the US?

Not usually a completely separate approach — tools like Complianz and CookieYes support both GDPR and US state laws like CCPA within the same plugin, often detecting the visitor’s region automatically and showing the appropriate banner. The main work is making sure your privacy policy and consent mechanism genuinely reflect both sets of requirements, which may be worth a short legal consultation if your client base is meaningfully split between regions.

How often should I update my website’s privacy policy?

Whenever your actual data practices change — adding a new booking tool, switching email platforms, or introducing a new analytics service should all prompt an update. Beyond that, a periodic review (alongside general site maintenance) helps catch anything that’s drifted out of sync with what the policy actually describes.

Sergio Stanga WordPress Web Designer & SEO Specialist · SR Web Marketing I help independent professionals and SMBs across Italy, Spain, and Europe build WordPress websites that generate long-term organic leads and AI search visibility — without depending on social media. About Sergio LinkedIn