GDPR and cookies for Estonian websites: a simple guide
GDPR sounds intimidating, but for a small business website the practical requirements are limited and manageable. Here is what your Estonian site actually needs, without the legal jargon.
The cookie banner is not optional theatre
If your site loads anything that tracks visitors, such as Google Analytics, you need real consent before it runs.
A banner that just says we use cookies with an OK button is not compliance. The visitor must be able to decline, and tracking must not run until they accept. The banner has to actually control what loads.
The easy path: cookieless analytics
The simplest way to reduce GDPR friction is to use analytics that does not set cookies, such as Plausible.
Cookieless analytics needs no consent banner for itself and still gives you the numbers that matter: visitors, sources, popular pages. Many small sites do not need anything heavier than this.
A real privacy policy
Your site needs a privacy policy that reflects what it actually does: what data you collect, why, how long you keep it, and how someone can request deletion.
A copied template that does not match your site is worse than useless. If you collect form submissions, say so. If you use analytics, name it. Honesty is the standard.
Form data and consent
When a visitor sends a contact form, they give you their name and email. Add a clear consent checkbox so they agree to that data being processed.
Keep form data only as long as you need it to handle the inquiry. Do not add people to a mailing list just because they sent a form. That is a separate consent.
FAQ
Do I need a cookie banner if I have no analytics?+
If your site sets no tracking cookies at all, you may not need a consent banner. But the moment you add analytics or ads that track, you do.
Is Google Analytics allowed under GDPR?+
It can be used with proper consent and configuration, but it adds complexity. Cookieless analytics like Plausible is the simpler compliant choice for most small sites.
Can I be fined for a small business site?+
Enforcement focuses on real violations and complaints, not tiny sites by default. Still, a proper banner and honest privacy policy are simple to do and remove the risk.