Cookies and consent
If your site uses any non-essential cookies (analytics, ads, social embeds), you need a cookie banner that asks for consent before they load.
The banner must offer a real choice. "Accept all" cannot be the only option. "Reject all" needs to be equally visible.
Until the visitor consents, no tracking scripts should fire. This is the rule that is most often broken and most easily checked.
Strictly necessary cookies (session, security, language) do not need consent, but should be listed in your cookie policy.
Privacy policy
A privacy policy is required for any site that collects personal data, which is almost every site (forms, analytics, IP logs all count).
It must say: what data you collect, why, on what legal basis, who else gets it (e.g. Google, your CRM, your hosting), how long you keep it, and what rights the visitor has.
Plain language is allowed and encouraged. A page no one reads is not the goal. A page a reader can actually understand is.
Forms and lead capture
Every form that collects personal data needs a clear purpose and a link to the privacy policy. "Send us a message" with no context is not enough.
Pre-ticked consent boxes are not allowed. The user must actively tick to consent, and you must store the fact and the time of that consent.
If you send marketing emails, you need separate consent for that, not a bundle with the contact form.
Analytics and tracking
Google Analytics 4 can be used in the EU, but only after consent and ideally with IP anonymisation and reduced data sharing.
Plausible, Fathom, and Simple Analytics are EU-friendly alternatives that work without cookies and without consent banners. For many small sites, they are simpler and just as useful.
Whatever you use, list it in your cookie and privacy policy. Hidden tracking is the fastest path to a complaint.
Data processors and contracts
Your hosting provider, email provider, CRM, and analytics tool are processors of your visitor data. GDPR requires a Data Processing Agreement (DPA) with each.
Reputable providers (Hetzner, Cloudflare, Google, Stripe) publish a DPA you can accept online. Keep a record of these acceptances.
If a tool is based outside the EU, check what transfer mechanism it relies on. The 2023 EU-US Data Privacy Framework covers most US providers, but smaller tools may not be certified.
What you do not need
You do not need a DPO (Data Protection Officer) for a typical small business website. The role is required only for large-scale or high-risk processing.
You do not need to register with the Estonian Data Protection Inspectorate just for running a website.
You do not need a cookie banner if your site truly uses zero tracking or non-essential cookies. A static site with no analytics is fully compliant by default.
A one-hour self-audit you can run in the browser
You do not need a consultant to find the most common faults. You need a private browser window and an hour.
- Open the site in a private window and do not touch the banner. Open the developer tools, look at the stored cookies and the network requests. If analytics or advertising requests are already there, the consent setup is broken.
- Click reject. Reload. The list should stay free of tracking cookies.
- Click accept in a fresh window. Now the tags may load. Then find the way to change your mind: a link in the footer that reopens the choices should exist.
- Repeat on a phone, and once in every language version of the site.
- Send your own contact form. Check where the message lands: whose mailbox, which CRM, whether a copy stays in the website database.
- Read your privacy policy against what you just saw. Every tool you found should be named there, and nothing you removed years ago.
After launch: requests, retention and incidents
A checklist for the website is only half of the work. The other half is what the company does when something happens.
Requests. A person may ask what you hold about them or ask you to delete it. The general deadline for answering is one month. Decide now which mailbox receives such requests and who replies, which matters most in a one-person OÜ where the owner is often travelling.
Retention. Delete old form submissions on a schedule. Order and invoice data is different: Estonian accounting rules require accounting documents to be kept for seven years, so an invoice cannot simply be erased on request. Your accountant confirms what exactly falls under that duty, and the privacy policy should mention it.
Incidents. If the site is hacked or a customer export goes to the wrong address, a breach that puts people at risk must be reported to the supervisory authority, for an Estonian company the Estonian Data Protection Inspectorate, within 72 hours of discovering it. Know who in your company makes that call.
Typical mistakes on Estonian sites in 2026
- The consent banner was set up once and then a new marketing tag was added outside of it.
- The banner is translated, the cookie policy behind it is not.
- An embedded video or map loads on the first view and sets third-party cookies before any choice.
- The shop's order emails go to a personal free mailbox that is not mentioned anywhere.
- Newsletter sign-up is a pre-selected option in the checkout.
- The privacy policy names a different company, left over from the template or the previous owner.
FAQ
Are the fines really that big?
Maximum fines under GDPR are large (up to 4 percent of global turnover or 20 million EUR), but in practice small businesses are far more likely to get a complaint and a request to fix it than a fine straight away.
Do I need a cookie banner if I only use Google Analytics?
Yes. Google Analytics counts as a non-essential tracking tool and requires consent before it loads.
Can I copy a privacy policy from another site?
No. The text must reflect what your site actually does. Copy-pasting a generic policy that does not match reality is a compliance risk.
A customer asks me to delete all their data, but they have bought from my shop. What do I do?
Typically you delete what you no longer need, such as marketing data and the customer account, and keep what the law obliges you to keep, such as invoices for the accounting retention period. Explain this in your reply. Your accountant or lawyer confirms the exact scope.
How often should I repeat the audit?
After every change that adds a tool: a new analytics tag, chat widget, advertising pixel, booking system or plugin. Without changes, once or twice a year is a sensible rhythm, because plugins and embedded services alter their behaviour in updates.