Is your website a privacy liability? A plain guide to tracking, cookies and the law

What does it mean for a website to respect privacy?

At its plainest, respecting privacy means a website collects and shares no more about its visitors than it genuinely needs to do its job. Every website involves some data — a server has to receive a request to send a page back — but there’s a wide gulf between that necessary minimum and the modern default, where an ordinary marketing site silently forwards each visitor’s information to a dozen third parties for analytics, advertising and convenience features the visitor never asked for.

The important distinction is between essential and non-essential processing. Essential things — the cookie that remembers your language, the request that loads the page — are part of making the site work. Non-essential tracking — analytics that profile behaviour, advertising pixels, social embeds that report back to their platforms — is added on top, and it’s this layer that privacy law regulates and that visitors increasingly resent. For most of the last decade the industry’s answer to that layer was “add a consent banner.” In 2026 the answer has shifted, because regulators and users alike have noticed that a banner changes nothing if the tracking runs regardless. The more durable answer is to reconsider whether the tracking needs to be there at all.

Does privacy law even apply to my site?

It probably applies more broadly than you’d expect, because the major privacy laws follow the visitor, not the business. The GDPR is explicitly extraterritorial: it applies based on where your data subjects are, so if your site is accessible to and collects data from EU residents, it can apply regardless of whether you operate from Canada, Latin America or anywhere else — the location of your company is irrelevant, the location of the people is what matters (Darge, 2026). The same follow-the-person logic runs through Brazil’s LGPD, Canada’s PIPEDA, and a growing patchwork of more than twenty US state laws such as California’s CPRA, most of which use an opt-out rather than opt-in model (Secure Privacy, 2026).

The practical consequence for a small business with any international reach is that several regimes can apply at once, each with its own rules about consent, disclosure and user rights. That sounds daunting, and a careful lawyer is the right person to map your specific exposure — this pillar is orientation, not legal advice, and the honest framing throughout is that we’re describing how these rules generally work, not certifying your compliance. But there’s a reassuring corollary hiding in the complexity: the less data you collect and share, the less of this thicket applies to you. Minimising collection is the one move that reduces risk under every one of these laws simultaneously. Our guide on whether GDPR applies to a non-EU business works through exactly when the law reaches a Canadian or Latin American company — and how the tracking you remove narrows that reach.

Why don’t most cookie banners actually work?

Here’s the finding that surprises people: an estimated 90% of websites with cookie banners are still non-compliant, frequently without knowing it (My Agile Privacy, 2026). The reason is a gap between how a banner looks and what it does. Under the GDPR and related rules, the requirement is prior blocking: non-essential and third-party scripts must not load before the user consents, meaning the tracking code shouldn’t execute at all until a choice is recorded (Intastellar, 2026). Most banners, and especially free plugins, only display a message while the analytics, pixels and embeds fire in the background anyway — which regulators treat as no valid consent at all, sometimes called cosmetic compliance (GDPR Cookie Compliance, 2026).

You can test your own site in about a minute. Open it in a fresh browser with cookies cleared, open the developer tools, and watch the network requests before you click anything on the banner. The compliant result is zero requests to tracking domains — no calls to analytics, ad networks or social platforms until you’ve chosen (My Agile Privacy, 2026). If you see those requests before making any choice, the banner is blocking nothing and is legally decorative. This is why “we added a banner, so we’re covered” is one of the most common and most dangerous assumptions a site owner can make. Our guide on whether you need a cookie banner at all works through when one is genuinely required — and when removing a tool removes the requirement.

The data your site leaks without you knowing

The tracking that a banner is supposed to gate usually arrives through ordinary, well-intentioned features. Third-party cookies and requests are introduced by plugins, embedded videos and maps, social buttons, analytics scripts — and, notably, by Google Fonts, which loads its stylesheets from Google’s servers and in doing so can transmit each visitor’s IP address to Google as the page renders (wp-gdpr.eu, 2026). European courts have treated exactly that kind of silent IP transfer as a privacy violation, which is why self-hosting fonts and assets has become a compliance question as much as a performance one — a theme our guide on self-hosting web fonts picks up in detail.

Analytics is the sharpest example. Beginning in late 2021, the privacy group noyb filed 101 complaints across nearly every EU member state targeting sites using Google Analytics, and in January 2022 the Austrian authority ruled that a website’s use of Google Analytics violated the GDPR because the resulting data transfer to US servers lacked adequate safeguards after the Schrems II ruling (Darge, 2026). Using Google Analytics lawfully now requires valid prior consent, a data-processing agreement, accurate disclosures and a valid transfer mechanism — and many organisations conclude that doing all of that correctly costs more in engineering and legal time than simply switching to a cookieless alternative (Darge, 2026). The pattern repeats across ad pixels, heatmaps and chat widgets: each convenience quietly exports data, and each one you remove is one less thing to consent to, disclose and defend.

Enforcement is coming for small sites now

For years the reassuring story was that regulators only pursued large platforms. That’s no longer true. Total GDPR fines passed €4.5 billion by mid-2024, with a marked rise in actions aimed specifically at basic cookie banners, and enforcement has broadened well beyond tech giants toward ordinary business websites (GDPR Cookie Compliance, 2026). Recent actions make the direction clear: France fined the retailer Shein €150 million for placing advertising cookies without valid consent, the Dutch authority fined Kruidvat €600,000 for pre-ticked consent boxes and issued formal warnings to more than 200 websites, and settlements have turned on nothing more than a misconfigured banner that prevented people from opting out (Trust Arc, 2026).

What changed in 2026 is the method. Regulators and automated auditing tools now inspect what a site actually does — whether scripts fire before consent, whether the reject option really works — rather than whether a banner is present (Trust Arc, 2026). The lesson for a small business is that the presence of a banner proves nothing; a temporary misconfiguration can create real exposure; and “we’re too small to be noticed” is a weaker defence every year. The cheapest insurance against all of it is to have less running on the page that could fire before consent in the first place.

The simplest compliance is not collecting the data

This is the heart of the matter, and it runs against the grain of an industry that sells consent tooling. Every requirement in the previous sections — prior blocking, consent logging, disclosures, transfer mechanisms, the whole apparatus — exists to manage tracking. Remove the tracking and most of the apparatus becomes unnecessary. A site that self-hosts its fonts and assets, makes no third-party requests, and measures traffic with cookieless analytics sets no non-essential cookies and sends nothing to outside companies, so there is little or nothing to gate behind consent, and often no cookie banner is required at all (Darge, 2026).

Cookieless analytics is what makes this practical for a real business rather than an act of self-denial. Tools such as Plausible, Fathom and Matomo count visits, pages and referral sources in aggregate without identifying individuals or tracking them across the web, which for most sites is exactly the information owners actually use (Darge, 2026). And the marketing objection — “won’t I lose targeting?” — has weakened: 2025 studies found contextual advertising matching cookie-based behavioural targeting to within a few percent on click-through and conversion (Digital Applied, 2026). The point isn’t that tracking is never justified; it’s that the default should be to collect the minimum, add tracking only where it earns its keep, and treat every third-party script as a cost — in privacy risk, in page speed, and in consent obligations — rather than a free convenience.

Dark patterns, and the trust dividend

There’s a second reason to prefer collecting less: the way you ask for consent is itself now under scrutiny, and doing it manipulatively backfires. Regulators have made clear that a compliant banner must present accept and reject with equal prominence — same size, colour and position — and that hidden reject buttons, pre-ticked boxes and “cookie walls” that block content until you accept are unlawful dark patterns (wp-gdpr.eu, 2026). Despite that, over a third of sites still make rejection deliberately harder than acceptance, which is exactly the design regulators are now targeting (My Agile Privacy, 2026).

The deeper shift is that privacy has become a business signal, not only a legal one. A large majority of consumers — around two-thirds in recent European research — say a company’s data handling is a decisive factor in choosing whether to use it, so treating consent as a trick to extract data erodes the trust it was meant to protect (My Agile Privacy, 2026). A site that visibly asks for little, tracks little and explains itself plainly reads as trustworthy in a way a nagging, asymmetric banner never will. Respecting privacy and looking professional turn out to be the same move, which is part of why it also supports the credibility signals that matter for being cited by AI systems.

How we build privacy in, rather than bolt it on

Stated plainly as the position we hold: on the sites we build, privacy isn’t a plugin added at the end — it’s a property of how the site is constructed. We self-host fonts and assets so nothing leaks to Google or anyone else on page load, we build with effectively no third-party requests so the “clean network tab” test passes by default, and we favour cookieless analytics so a site gathers the numbers its owner needs without the consent machinery behavioural tracking demands. The result is a site that is, for most businesses, compliant by construction rather than by a bolted-on banner — and that happens to load faster and score better on performance precisely because it isn’t dragging in outside scripts. Privacy, speed and simplicity are, once again, three views of one architectural decision.

The honest gate matters here as much as anywhere, and it has two parts. First, we’re not lawyers: this pillar and the guides beneath it explain how the rules generally work and how architecture reduces your exposure, but your specific obligations depend on your jurisdictions and your data, and a qualified professional should confirm them. Second, minimalism isn’t right for every site — if your business genuinely depends on behavioural advertising, cross-site retargeting or detailed marketing attribution, you will need real consent management done properly, and we’ll tell you that plainly rather than pretend a cookieless setup covers it. What we won’t do is add a decorative banner over a site that leaks, call it compliance, and leave you exposed. For the large majority of businesses whose site is there to inform, persuade and convert rather than to run an ad-tech operation, building privacy in is simpler, cheaper and safer than bolting it on.

The cheapest, safest compliance is the tracking you never added

Step back and the whole subject collapses into one idea: the burden of privacy compliance comes from the data you collect, so the least burdensome site is the one that collects the least. A decorative banner over a leaking site is the expensive path — it manages a problem instead of removing it, and it fails exactly when a regulator or an automated scan looks past the banner to what actually runs. An architecture that doesn’t leak in the first place is the cheap path, and it pays a second time in speed and a third time in trust.

So the useful way to think about your site’s privacy is to start from what it loads, not from which banner to buy: audit the third-party requests, remove the ones that don’t earn their place, self-host what you can, choose analytics that don’t identify people, and add consent management only for the tracking that genuinely remains — then describe whatever’s left in a short, honest privacy policy — then describe the modest result in a short, honest privacy policy that stays true because there’s little to describe. Do that and privacy stops being a legal anxiety bolted onto a site that quietly works against you, and becomes what it should be — a quiet property of a site that respects the people who visit it, which is the same “do it right once” logic that runs through our guides on what a website costs, performance and the rest of this library.