Cookie Consent & Privacy Compliance for Small Websites
A Practical Guide to Meeting GDPR, ePrivacy, and Cookie Requirements Without a Legal Team
Free · EPUB · ~28+ pages · Kindle, Apple Books & any e-reader
8 chapters + 2 appendices
Cookie banner templates
Privacy policy structure
Download the full EPUB — freeWhat's Inside
- Chapter 1 — What the Law Actually Requires
- Chapter 2 — Cookies and Tracking Technologies — An Inventory
- Chapter 3 — Building a Compliant Cookie Banner
- Chapter 4 — Consent at Scale — Record-Keeping
- Chapter 5 — Privacy Policy — What Must Be In It
- Chapter 6 — Handling Data Subject Requests
- Chapter 7 — Analytics Without Consent Violations
- Chapter 8 — Common Compliance Traps
- Appendix A — Quick Implementation Checklist
- Appendix B — Resources
Read it before you download
The opening of the book, straight from the EPUB you get below — not a summary written for this page. 2 chapters in full, then the rest is free to download.
Read the first 2 chapters online
Chapter 1: What the Law Actually Requires
Three pieces of EU law govern cookies and privacy on websites:
GDPR (General Data Protection Regulation)
The GDPR — Regulation (EU) 2016/679 — applies whenever you collect or process personal data from EU residents. Personal data includes IP addresses, which means virtually every website tracking visitor behaviour is affected.
What you need: A lawful basis for processing personal data. For most cookie-related processing, consent is the appropriate basis.
ePrivacy Directive (Cookie Law)
The ePrivacy Directive — Directive 2002/58/EC, amended in 2009 — is the specific law that requires cookie consent. Article 5(3) states that storing or accessing information on a user's device requires their consent, unless it's strictly necessary for the service.
What you need: Active, informed consent before non-essential cookies are set. A "by continuing to use this site you accept cookies" banner is not compliant.
The interplay
The GDPR sets the general data protection framework. The ePrivacy Directive sets the specific rules for electronic communications. Both must be satisfied. In practice: you need GDPR-compliant consent (freely given, specific, informed, unambiguous) for ePrivacy-covered tracking.
National implementations
EU directives are implemented at the member state level, which means minor differences apply:
| Country | Cookie law reference | Key specificity |
|---|---|---|
| Denmark | Cookie Executive Order | First cookie must be declined on landing, explicit consent before analytics |
| Germany | TTDSG | Strict "only strictly necessary without consent" approach |
| France | RGPD + CNIL guidelines | Heavily enforced; CNIL actively fines non-compliant sites |
| Netherlands | Telecommunicatiewet | Similar to Danish approach; consent before analytics |
| UK (post-Brexit) | PECR (UK) | Similar to ePrivacy, enforced by ICO |
Chapter 2: Cookies and Tracking Technologies — An Inventory
Before you can implement compliant consent, you need to know what's running on your site.
Categories of cookies
| Category | Examples | Requires consent? |
|---|---|---|
| Strictly necessary | Session cookies, CSRF tokens, shopping cart | No — exemption for "strictly necessary" |
| Functional/preference | Language preference, theme choice | Yes — unless genuinely necessary for the service |
| Analytics | Google Analytics, Plausible, Fathom | Yes — IP addresses are personal data |
| Marketing/tracking | Facebook Pixel, Google Ads, TikTok | Yes — always requires consent |
| Third-party embeds | YouTube videos, Google Maps, Twitter feed | Yes — these set third-party cookies |
Analysing your site
Browser DevTools > Application > Storage > Cookies: Lists all cookies your browser stores for the current site. Check after loading a page.
Cookie audit tools: Free tools like Cookiebot's scanner, CookieYes scanner, or the PrivacyBee extension can scan your site for cookies.
Check your third-party scripts: Google Analytics, Facebook Pixel, Hotjar, Microsoft Clarity, and most analytics tools set cookies. So do embedded YouTube videos, Google Maps, Typeform embeds, and social media widgets.
Document your findings
Create a simple table:
| Cookie name | Provider | Purpose | Category | Expiry | Requires consent? | |-------------|----------|---------|----------|--------|-------------------| | _ga | Google | Analytics | Analytics | 2 years | Yes | | _gid | Google | Analytics | Analytics | 24 hours | Yes | | PHPSESSID | Self | Session | Necessary | Session | No | This becomes your cookie policy.
The same three checks, on your own site: the free cookie consent checker reads the banner, the script tags and the privacy link.
Check my cookiesThe rest of the book is free — the download button below has every chapter and every appendix, in EPUB for any e-reader.
The book explains the cookie rules. A tool reads what your site actually does.
The banner templates in chapter 3, the record-keeping in chapter 4 and the privacy policy structure in chapter 5 are all in the EPUB, free, and nothing in it is held back. What no book can do is open the site you shipped last month and say whether the consent banner is still there, whether the analytics loads before consent, and whether the privacy link is still in the footer. EUComply Pro does that: it reads the site from the server and runs 33 checks — the same 15 accessibility rules, plus 18 server-side checks that cover GDPR and cookies, security headers and metadata — and hands you the findings as a PDF you can send to the client. $79/year, per website.