GDPR and cookies for a small business website

01What cookies really are, and why the law cares about them

This chapter is written for anyone who works or runs a business in Italy: the rules, the authority and the documents cited are the Italian ones, within the European legal framework. A cookie is a small text file that a website asks the browser to keep. On the next visit the browser sends it back, and the site "remembers" you: the language you chose, your cart, the fact that you have already logged in. In itself it is a harmless tool, and it is what makes much of the web as we know it possible.

Picture a scene that happens every day. A pastry shop launches its new website: three pages, photos of the cakes, a YouTube video about the bakery and a map to find the shop. Nobody at the pastry shop has ever thought about cookies. And yet, as soon as a customer opens the page, their browser has already talked to at least two servers that do not belong to the pastry shop. There is no bad faith: there is a piece pasted in without knowing what it brings along. This chapter is here so you know what it brings along.

The problem arises when the same mechanism is used to follow people: from one site to another, from one session to the next, to build a profile of their interests and show targeted advertising. That is why European law does not regulate the file itself, but access to the visitor's device: writing or reading something on a person's phone or computer requires their consent, unless it is strictly necessary to provide the service they asked for.

In Italy this rule is set out in article 122 of the Codice privacy, the Italian data protection code, which transposes the European directive known as "ePrivacy". The GDPR, the European General Data Protection Regulation, governs everything that happens afterwards: which data are collected, on what legal basis, for how long, with what safeguards.

Not just cookies: the other tracking tools

The guidelines of the Garante Privacy, the Italian data protection authority, do not speak only of cookies, but of "cookies and other tracking tools". The same rule covers:

• pixels, invisible one-dot images that notify a third-party server when the page is opened;
• the browser's local storage (localStorage and the like), when it keeps identifiers and not just technical preferences;
• fingerprinting, that is, recognizing a device from the combination of its characteristics (screen, installed fonts, browser version), which works even without saving anything.

So what matters is the purpose, not the technology: if the tool is used to recognize the person for purposes that are not essential to the service, consent is required.

First party and third parties

One distinction clarifies almost everything else: first-party cookies, installed by the site you are visiting, and third-party cookies, installed by other parties whose pieces are embedded in the page: the YouTube video, the Google map, the "like" button, the advertising pixel. The site owner is responsible for these too, because they chose to include them.

02The three families: technical, analytics, profiling

To find out whether a site needs a banner, you have to take an inventory of what it installs and put each tool in its family. There are three families, and only one always requires consent.

Technical cookies

These are the ones strictly necessary to provide the service the person asked for: keeping them logged in to a private area, remembering the contents of the cart and the chosen language, protecting a form from automated submissions, spreading traffic across several servers. Without them the site does not work the way the person expects. They do not require consent: it is enough to say they are there, in the privacy notice.

Analytics cookies

They count visits and show how the site is used: which pages are read, where people come from, on which devices. Here the Garante's 2021 guidelines make an important distinction. Analytics cookies can be treated like technical ones, and so without consent, only if all of these conditions are met together:

• they do not allow the person to be identified directly: for example, the IP address is masked, at least in its last part;
• they are used only to produce aggregate statistics;
• they concern a single site (or a single app), without following the person elsewhere;
• if the service is provided by a third party, that party does not match the data with other information and does not pass it on to others.

If even one of these conditions is missing, analytics become tools that require consent, exactly like profiling ones.

Profiling and marketing cookies

These build a profile of the person in order to show targeted advertising or personalize content based on their behavior, often across several sites. They are almost always present when a page contains social media pixels, advertising platforms and many embedded third-party services. For these, prior consent is always required: nothing is installed before the person has said yes.

03Do you need a banner? The right question to ask

Many sites show a banner "just to be safe", even when they install nothing that requires one. It is a double mistake: it annoys visitors for no reason, and it is often badly made, so it does not even protect the site owner. The right question is not "should I add a banner?" but "what does my site install?". The answer to the first question follows on its own.

The rules of a well-made banner

When a banner is needed, the Garante's guidelines of June 10, 2021 set out how it must work. The rules that matter most for a small business:

• Scrolling the page is not consent. A simple scroll is not enough: a positive action that can be recorded is required, such as clicking a button.
• The X closes and refuses. The banner must have a close command, usually an X in the top right corner; closing it keeps the default settings, that is, no non-technical tool installed.
• Refusing must be as easy as accepting. A big, colorful "Accept" button with the refusal hidden at the bottom of a second page is not acceptable.
• Choices by category. The person must be able to accept some purposes and not others, for example statistics yes and advertising no.
• No "cookie wall". Making access to the site conditional on accepting cookies is, as a rule, unlawful, subject to case-by-case assessment when an equivalent alternative without consent exists.
• The banner does not keep coming back. After a refusal it can be shown again only if the conditions change significantly (for example, new third parties) or if at least six months have passed.
• The choice can be changed. A link that is always reachable, usually in the footer, lets the person review their consent at any time.

04External services: videos, maps, pixels and fonts

Most small business websites do not install profiling cookies on purpose. They install them by inertia, through pieces taken from other services and pasted into the page because they are convenient. Each of these pieces does something the visitor does not see: the browser contacts another server, sends it the IP address and often receives or reads a cookie.

The embedded video

A YouTube or other platform frame, pasted in with the embed code, loads the player files from the platform's servers as soon as the page opens, even if nobody presses "play". There is a "privacy-enhanced mode" (the youtube-nocookie.com address) that reduces tracking until the video starts, but does not eliminate it. The cleanest solution is two-click loading: in place of the player there is an image with a notice, and the real video loads only when the person asks for it.

The interactive map

The same applies: an embedded map connects to the provider's servers when the page opens. To help people find your premises, a static image of the map, saved on your own server, is often enough, together with an "Open in Maps" link that takes the person to the app only if they want.

Social media and advertising pixels

A pixel exists, by definition, to measure who has seen what, and then show advertising to those people: it is profiling, and it always requires prior consent. It cannot start when the page loads, only after the "yes". Plain links to social media profiles, on the other hand, are normal links: until they are clicked, nothing happens.

Fonts loaded from outside

This is the subtlest case. Services such as Google Fonts, when they only provide the font files, do not install cookies; but the browser downloads them from the provider's servers, and so sends it the visitor's IP address. In Germany, the Regional Court of Munich, in a ruling of January 20, 2022, awarded a visitor 100 euros in damages precisely for this transmission without a legal basis. It is not an Italian ruling, and German courts later rejected the mass claims that arose from that case, but the principle is clear: even a call to a third party without cookies must be disclosed, and it can be avoided entirely by hosting the fonts on your own server.

Third-party statistics

In June 2022 the Garante, at the end of an investigation coordinated with the other European authorities, declared unlawful the use of Google Analytics by an Italian website because of the transfer of data to the United States without adequate safeguards. In July 2023 the European Commission then adopted a new adequacy decision for transfers to US companies participating in the "Data Privacy Framework", which changed the picture for transfers. What has not changed is the consent rule: if the tool does not meet all the conditions to be treated as technical, consent is required before activating it.

Beyond privacy, every external piece also weighs on speed: scripts, fonts and video players are among the most frequent causes of slow pages. I explain this in the chapter on Core Web Vitals.

05The documents you really need

The banner, when there is one, is only the visible part. Behind it are a few documents that the GDPR requires of anyone who processes personal data, even a small business with a website of a few pages. The starting point is always the same: which data I collect, why, and where they end up.

The privacy notice: written to be understood

Article 12 of the GDPR requires information to be provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language. A text copied from another site, full of processing your site does not do, does not meet this rule: it says false things, and a notice that misdescribes what happens is a problem in itself. It should be written starting from the real inventory and updated every time the site changes.

Legal bases: not everything is consent

A common mistake is to think that every processing activity requires consent. Article 6 of the GDPR provides six different legal bases, and for a website the most frequent are three:

• the performance of a contract or of steps requested by the person: answering a quote request, handling a booking, delivering an order;
• a legal obligation: keeping invoices, meeting tax obligations;
• consent: sending a promotional newsletter, installing profiling tools.

Asking for consent that is not needed, for example to answer a question sent through the contact form, adds no protection and confuses the person.

The site's forms

Every form that collects data must have, next to the submit button, a short reference to the privacy notice. If the form is also used for marketing purposes, the consent box must be separate and unticked by default: consent is given with an active gesture, not removed. For mailing lists, double opt-in is good practice, the email asking you to click a link to complete the subscription, which is also the best proof of consent. How to build email communication that follows these rules and actually reaches the inbox is explained in the chapter on professional business email.

06Privacy also means protecting the data

The GDPR does not only ask for paperwork in order: it requires the data collected to be protected in a way appropriate to the risk (article 32). For a small business website this means a few very concrete things:

• the site responds only over HTTPS, so form data travel encrypted;
• you collect only the data you need: a contact form does not need a date of birth;
• the data collected do not linger in shared mailboxes or forgotten spreadsheets, but sit in a place with controlled access;
• access to the admin area is protected by strong passwords and a second factor, as I explain in the chapter on passwords, two-factor authentication and passkeys;
• there are backups and a plan for when something goes wrong.

If a portal collects bookings, customer logins or payments, the topic widens to encryption, protection against attacks and database design: I cover it in the chapter on integrated portals, bookings and PWAs.

When something goes wrong: the data breach

An attack, stolen credentials, a lost computer holding customer data: the GDPR calls these events a personal data breach. If the breach poses a risk to people, the controller must notify the Garante within 72 hours of becoming aware of it (article 33) and, if the risk is high, also inform the people concerned (article 34). All breaches, including those not notified, must be documented in an internal register. How to prepare in advance, with backups and a recovery plan, is the topic of the chapter on business backup and ransomware.

What is at stake

Article 83 of the GDPR sets the limits of administrative fines: up to 10 million euros or 2% of annual worldwide turnover for some infringements, up to 20 million or 4% for the most serious, such as processing without a legal basis or violating people's rights. These are maximum caps, and the Garante scales the fine according to severity, duration, cooperation and the size of the controller. For a small business, though, the most concrete risk is often something else: a customer complaint, a reprimand with an order to comply, and lost trust.

A compliant site is not the one with the biggest banner. It is the one that collects only what it needs, says so in clear words and looks after it well.The data minimization principle, in practice

07Checking your site in seven steps

You can do a first check on your own, with a browser and half an hour. It does not replace a professional review, but it tells you right away whether there are obvious problems.

1. Open the site in a private window, so there are no choices saved from previous visits.
2. Before clicking anything, open the developer tools (F12), Application tab, Cookies: if there are already third-party or profiling cookies, the prior block is not working.
3. In the Network tab, reload the page and look at the domains contacted: every domain that is not yours is an external service to list.
4. If there is a banner, close it with the X and check again: nothing new should appear.
5. Try to refuse: it should take one click, like accepting.
6. Read the privacy notice and the cookie policy: do they really describe what you saw in the Network tab?
7. Check the forms: is there a reference to the privacy notice, and are the marketing boxes empty by default?

Part of this work depends on the site's code: the prior block, on-request loading of videos, self-hosted fonts. Anyone choosing a provider for their website should ask, right from the quote, how these points will be handled and in whose name the data and tools will be registered: I discuss this in the chapter on who really owns your website.

Frequently asked questions

Sources

1. Garante per la protezione dei dati personali, "Guidelines on cookies and other tracking tools", June 10, 2021 (in Italian): scrolling, the X command, analytics treated as technical, cookie walls, six months.
2. Garante per la protezione dei dati personali, "Cookie" topic page (in Italian): the rules in brief and the related documents.
3. Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex (Italian version, other languages available on the page): articles 6, 7, 12, 13, 28, 30, 32, 33, 34 and 83.
4. Garante per la protezione dei dati personali, press release of June 23, 2022 on Google Analytics (in Italian): the transfer of data to the United States.
5. European Commission, adequacy decision on the EU-US Data Privacy Framework, July 10, 2023.
6. IHK, fact sheet on the ruling of the Landgericht München I of January 20, 2022 (3 O 17493/20) on Google Fonts (in German).

Chapter updated October 2026. This is an informational guide written by someone who builds websites and software, not legal advice: for particular cases, and to draft your business's privacy notice and record of processing, it is wise to work with a data protection professional. The rules cited come from the official texts listed above.