Privacy and cookies for a small business website

The short version

• Write down what your site collects and which outside tools load on it. Everything else depends on that list.
• Post a privacy policy that matches the list, in plain words, linked from every page.
• Do EU or UK rules apply to you, because you serve or track people there? Ask before non-essential cookies, apart from narrow exceptions, and make Reject as easy as Accept.
• Check whether a US state privacy law applies to you. Most have size thresholds; a few rules apply to almost everyone.
• Collect less, keep it for less time, and have a plan for when someone asks what you hold.

This isn’t legal advice. Privacy law depends on where you and your visitors are, what you do with the data, and your industry. For anything unclear, ask a lawyer who handles privacy.

How do I get my site’s privacy in order?

Work through these five steps in order. Each one links to a guide with the detail, checked against regulators’ own guidance on October 31, 2026.

1. Make an inventory

Open your website and list what it collects and who else it talks to. Look for:

• Forms: contact, quote, booking, newsletter and job application forms, and every field on them.
• Analytics: Google Analytics, Microsoft Clarity, a WordPress stats plugin, or anything similar.
• Advertising: the Meta pixel, Google Ads tags, LinkedIn Insight tag and remarketing tools.
• Embeds: YouTube videos, Google Maps, booking widgets, chat bubbles, review widgets and social feeds.
• Where data lands: your website’s saved entries, staff inboxes, your CRM, spreadsheets, your email list tool and backups.

If you’re not sure what loads, our free tools hub explains how to check your site with Google Tag Assistant. Your web company can also give you the list.

2. Write a privacy policy that matches

A privacy policy is a promise. The FTC’s privacy and security guidance tells businesses to honor the promises in their policy. The FTC treats misleading privacy claims as deceptive. So the best policy is short, specific and true. It says who you are and what you collect. It says why, who you share it with, how long you keep it, and how to reach you.

California’s online privacy law, CalOPPA, applies to any commercial website that collects personal information from California residents, with no size threshold. The California Attorney General’s guide to privacy policies lists what a policy must cover. That’s the types of information collected and the kinds of companies it’s shared with. It’s also how people can review or change it, the effective date, and how the site responds to Do Not Track signals. Our guide to what a small business privacy policy should cover has a full checklist.

3. Decide if you need cookie consent

This is the part most owners get wrong in one direction or the other. Europe and the UK use an opt-in model: you ask before setting cookies that aren’t strictly necessary. Most US state laws use an opt-out model: people can tell you to stop selling or sharing their data, or stop targeted ads.

Diagram: the EU and UK opt-in model next to the US state opt-out model, simplified. Based on ICO, EDPB, California, Colorado and Connecticut guidance (October 2026). Not legal advice.

Do you have EU visitors? The European Commission’s page on who the GDPR applies to says it can cover a business outside the EU. That’s when it offers goods or services to people in the EU or monitors their behavior. A plumber in Ohio with no European customers is in a very different spot from a shop that ships to France. Our guide do I need cookie consent? walks through the questions, and making a consent banner accessible covers the design.

4. Check the US state laws

California, Colorado, Connecticut, Texas and a growing list of other states have broad privacy laws. Most only apply above a size threshold. California’s CCPA, for example, applies to for-profit businesses that do business in California and meet one of three tests. The CPPA’s threshold page sets the revenue test at $26,625,000 from January 1, 2025, after an inflation adjustment. The other tests are data on 100,000 or more California residents or households, or half or more of revenue from selling or sharing data.

Small doesn’t always mean exempt. The Texas Attorney General says Texas’s law mostly exempts small businesses, as the SBA defines them. They still need consent before selling sensitive data. And several states treat the browser’s Global Privacy Control signal as a valid opt-out. See which US state privacy laws apply to a small business and what Global Privacy Control means for your site.

5. Keep less, and be ready for requests

The FTC’s guide to protecting personal information boils it down to “Keep only what you need for your business.” That’s good law and good security. Ask for less on forms. Let entries delete themselves after a set time, once you’ve checked what you must keep for tax, legal or insurance reasons. Give staff access only to what they need. Each step cuts what can leak. Our guide on what your forms collect and how long to keep it shows how. Our guide on how to handle a data request covers the day someone asks.

What this looks like for a typical local business

Take an example: a roofing company in Pennsylvania with a WordPress site. It has a quote form, Google Analytics, a Google Map on the contact page and a Facebook pixel from an old ad campaign. Its customers are all local. (This is an illustration, not a real client.)

• Inventory: four tools plus the form. The pixel hasn’t been used in two years.
• Clean-up: remove the pixel. That’s one less company receiving visitor data, and one less reason for a banner.
• Policy: a one-page policy naming the form, the host, the email service, Google Analytics and the map, with a Do Not Track line for California visitors.
• Consent: with no customers or tracking aimed at Europe and no ad tracking left, a full consent banner may not be needed. The owner checks that with an adviser.
• Retention: quote requests that don’t turn into jobs are deleted after a set period. Inbox copies are cleared monthly.
• Requests: a short note in the office manual on what to do if someone asks for their data.

The same business running retargeting ads, or shipping products to Europe, would have more to do. That’s why the inventory comes first.

Which guides go deeper?

Each guide answers one question:

• What should a small business privacy policy cover? The sections regulators list, in plain words, and the mistakes that make a policy untrue.
• Do I need cookie consent on my website? How the EU, UK and US rules differ, including the UK’s new analytics exception.
• Which US state privacy laws apply to a small business? Thresholds, opt-outs and the rules that apply regardless of size.
• What is Global Privacy Control, and do I have to honor it? The browser signal several states treat as an opt-out.
• What is Google Consent Mode v2? What it does, basic versus advanced, and who needs it.
• Can I measure my website with fewer cookies? GA4 settings, cookieless tools and their trade-offs.
• How long should I keep form submissions? Finding every copy and setting a retention schedule.
• Does COPPA apply to my website? The children’s privacy rule and its 2025 changes.
• How do I handle a request to see or delete someone’s data? Deadlines, identity checks and WordPress’s built-in tools.
• Which vendors handle my customers’ data, and what should I check? Processors, contracts and the tools you’ve added over the years.
• How do I make a cookie banner accessible? Keyboard, screen readers, focus and fair button design.

Why does privacy matter for a small business site?

Three reasons, in order of how often they come up.

Trust. People are wary of forms. A clear policy link next to the submit button, and a form that only asks for what’s needed, tells them you’ve thought about it.

Your tools require it. Google’s EU user consent policy covers visitors from the European Economic Area, the UK and Switzerland. Sites using Google products must get consent where the law requires it and keep records of it. The Google Analytics terms say you must post a privacy policy. It must mention your use of cookies and of Google Analytics. Microsoft says that, starting October 31, 2025, Clarity enforces consent signals for visits from the EEA, UK and Switzerland.

The law, where it applies. Regulators in Europe, the UK and US states do act on websites. In the US, the FTC can act on privacy promises a business doesn’t keep, whatever its size.

What are the most common mistakes?

• A copied policy. A policy lifted from another site describes another business’s tools. It can promise things you don’t do, which is worse than saying less.
• A banner that doesn’t block anything. Many banners show a message while analytics and ad tags fire anyway. The banner has to control the tags.
• No Reject button. The EDPB’s Cookie Banner Taskforce report recorded the view of most European regulators. An Accept button with no equal way to refuse doesn’t give valid consent.
• Forgotten tools. An old Facebook pixel or chat widget still loads years after anyone used it.
• Keeping everything forever. Years of form entries, inbox copies and spreadsheets, none of which anyone needs.
• Asking for too much. Date of birth, full address or ID numbers on a simple contact form.

Which rules have changed recently?

Older guides still teach some outdated rules. Here’s where things stand on October 31, 2026.

• UK: new cookie exceptions. The Data (Use and Access) Act 2025 changed the UK’s cookie rules. The ICO’s storage and access technologies guidance, was finalised on April 29, 2026. It lists five exceptions, One is “statistical purposes,” for analytics used only to improve your site. You still have to explain it and give people a simple way to object. Advertising is not covered.
• Google Consent Mode v2. Google added two consent settings, ad_user_data and ad_personalization. From March 2024, ad personalization and remarketing for European traffic need consent signals. See our consent mode guide.
• COPPA amendments. The FTC’s amended children’s privacy rule was published on April 22, 2025 and took effect June 23, 2025. Most businesses had until April 22, 2026 to comply. See does COPPA apply to my website?
• CCPA regulations. California’s privacy agency adopted new rules in September 2025 on risk assessments, cybersecurity audits and automated decision-making. Its consolidated regulations are dated effective January 1, 2026.
• Clarity consent. Microsoft Clarity began enforcing consent signals for European visitors on October 31, 2025.

What if something goes wrong?

• Someone asks what data you hold, or asks you to delete it. Log the date and follow our data request guide. Deadlines are short.
• You find a tool loading that you didn’t know about. Remove it if nobody uses it. If you need it, add it to your policy and, where required, your consent banner.
• A form was collecting something sensitive. Remove the field, delete the old entries you don’t need, and check every place copies went.
• You get a letter from a regulator or a lawyer. Don’t ignore it and don’t argue by email. Talk to a lawyer before you reply.

How much does it cost, and how long does it take?

The inventory takes an hour or two for a typical small site. Writing or fixing a policy takes an afternoon. WordPress includes a free privacy policy page helper, and many consent tools have free tiers for small sites, though limits vary by vendor. If a law firm drafts your policy, ask them for a quote; prices vary widely.

How does E-3 handle this?

We’re a web studio, not a law firm, so we don’t write legal policies or tell you which laws apply. We handle the technical side as part of our website care service. We can list what loads on your site and remove tools nobody uses. We can set up form retention. We can install and test a consent banner so it really blocks tags until a visitor chooses. You decide which changes to make. Settings and tag changes can usually be reversed. Deleted data can’t be brought back, so check what you need to keep before anything is deleted.

Related questions

• How do I share logins with staff and vendors safely?
• What should I look at in Google Analytics 4?
• Where should form entries be stored?
• Website accessibility: a practical start

Sources

1. Guidance on the use of storage and access technologies (ICO)
2. What are the exceptions? (ICO storage and access technologies guidance)
3. Report of the work undertaken by the Cookie Banner Taskforce (EDPB, January 2023)
4. Who does the data protection law apply to? (European Commission)
5. California Consumer Privacy Act (CCPA) (California Attorney General)
6. Updated monetary thresholds in CCPA (California Privacy Protection Agency)
7. Attorney General issues guide on privacy policies and Do Not Track disclosures (California Attorney General)
8. Privacy and security business guidance (FTC)
9. Protecting personal information: a guide for business (FTC)
10. Google Analytics terms of service (Google Marketing Platform)
11. EU user consent policy (Google)
12. Texas Data Privacy and Security Act (Texas Attorney General)
13. CCPA regulations (California Privacy Protection Agency)
14. Settings Privacy screen (WordPress documentation)
15. Consent mode overview (Google Tag Platform)
16. Children's Online Privacy Protection Rule, final amendments (Federal Register, April 22, 2025)
17. Consent Mode (Microsoft Clarity documentation)