GDPR and cookies for Estonian websites: a simple guide

If your site loads anything that tracks visitors, such as Google Analytics, you need real consent before it runs.

A banner that just says we use cookies with an OK button is not compliance. The visitor must be able to decline, and tracking must not run until they accept. The banner has to actually control what loads.

The simplest way to reduce GDPR friction is to use analytics that does not set cookies, such as Plausible.

Cookieless analytics needs no consent banner for itself and still gives you the numbers that matter: visitors, sources, popular pages. Many small sites do not need anything heavier than this.

Your site needs a privacy policy that reflects what it actually does: what data you collect, why, how long you keep it, and how someone can request deletion.

A copied template that does not match your site is worse than useless. If you collect form submissions, say so. If you use analytics, name it. Honesty is the standard.

When a visitor sends a contact form, they give you their name and email. Add a clear consent checkbox so they agree to that data being processed.

Keep form data only as long as you need it to handle the inquiry. Do not add people to a mailing list just because they sent a form. That is a separate consent.

For a company registered in Estonia the data protection supervisor is the Estonian Data Protection Inspectorate, in Estonian Andmekaitse Inspektsioon. It publishes guidance, handles complaints from individuals and is the body a visitor would turn to if they felt your site misused their data.

This matters to e-residents in a practical way. You may live in Brazil or Turkey, but if the OÜ is the one collecting form submissions and orders, the OÜ is the data controller and EU rules apply to it. Your privacy policy should therefore name the Estonian company, not you personally and not a brand name.

If the business is really managed from another EU country, or has staff and offices in several, which authority takes the lead can be less obvious. That is a question for a lawyer, not for a website template.

The general content of a privacy policy is the same everywhere. The details that make it yours are local.

• •The controller: full company name with OÜ, registry code and registered address.
• •A contact for privacy requests: an email address that someone actually reads.
• •Recipients typical for an Estonian site: the payment provider (Montonio, Maksekeskus, Stripe), the carrier whose parcel locker the buyer picks (Omniva, SmartPosti, DPD), your hosting company, your email service and your accounting software.
• •The right to complain to the supervisory authority, with the Inspectorate named.

Buyers hand a phone number to a carrier every time they choose a locker, because the pickup code arrives by text message. Say so in plain words. It is the kind of detail copied templates never contain.

Picture a hypothetical Tallinn bike repair shop with a site in Estonian, Russian and English, Google Analytics, and an embedded map.

The banner and the privacy policy need to exist in all three languages, because consent only means something if the visitor understood the question. A banner that stays in English on the Estonian page is a common and avoidable flaw.

The choice should be stored once and respected across language versions, so a visitor who declined on the Estonian page is not asked again on the Russian one. And the embedded map deserves attention: it can set cookies of its own, so either load it after consent or replace it with a static picture that links to the map.