GDPR cookie consent and Privacy Policy, for small businesses.

The GDPR applies to your US business when you offer goods or services to people in the EU, or track their behavior. Article 3(2) sets these 2 cases for businesses outside the EU.

Shipping to EU addresses, prices in euros and pages in EU languages point to an offer to people in the EU (Recital 23). Analytics or advertising tools that follow EU visitors point to monitoring (Recital 24). A website that people in the EU reach is not enough on its own.

Check the table on this page to see which case fits your business.

No, the GDPR has no exemption for small businesses. The rules on consent, Privacy Policies and data requests apply to a business of 3 people the same way they apply to a business of 3,000.

Article 30(5) narrows one duty, the record of processing activities, for businesses with fewer than 250 employees. The exception ends when the processing is more than occasional, which is the case for a website that runs analytics every day.

Yes, you need a cookie banner for Google Analytics when your website has visitors in the EU.

Google Analytics stores cookies that your website does not need to work, and Article 5(3) of the ePrivacy Directive asks for consent before such cookies. It follows visitor behavior, which brings a business outside the EU under the GDPR (Article 3(2)(b)). The Google EU user consent policy asks for consent from users in the EEA, the UK and Switzerland when a website uses Google measurement tags.

Add Google Analytics 4 as a vendor in Privacy Consent, and the script loads only after the visitor agrees.

Yes, a website that tracks visitors in the EU needs both a Privacy Policy and a cookie banner. Each does a different job.

The Privacy Policy tells visitors what personal data you collect, why, and for how long (GDPR, Articles 13 and 14). The cookie banner asks for consent before non-essential cookies load (ePrivacy Directive, Article 5(3)). A Privacy Policy alone never replaces consent.

Generate the Privacy Policy with the Privacy Policy Generator, and create the consent banner with Privacy Consent.

Yes, you can show the opt-in banner only where the law asks for consent, with Standard consent logic from the Starter plan. Privacy Consent detects where each visitor is and applies the rules for that region.

With Standard, visitors in the EU, the EEA, the UK, Switzerland and Quebec see the opt-in banner, and vendor scripts wait for consent. Visitors in the US get the opt-out model, with the Your Privacy Choices link. The banner still asks every visitor when your business is in the EU, the EEA, the UK or Switzerland, or when a vendor processes sensitive data.

Strict consent logic, on every plan and the only option on the Free plan, shows the banner to every visitor.

Privacy Consent records every consent choice in the consent log, which helps you show consent as Article 7(1) of the GDPR asks.

The consent log keeps each choice for 180 days (6 months) on the Free plan and 730 days (24 months) on the Starter, Pro and Business plans. Every plan exports the consent log as a CSV file.