GDPR checklist for your website: what to watch out for in 2026

GDPR. Four letters that scare many website owners. And not entirely without reason: the fines are hefty, the rules complex, and the cease-and-desist waves don't stop. But don't panic. In this article you'll get a clear, practical checklist you can work through point by point.

I'm not a lawyer and this does not replace legal advice. But as someone who builds websites for local businesses, I know the typical pitfalls and how to avoid them.

Why GDPR compliance is more important than ever in 2026

The General Data Protection Regulation has been in force since 2018, but enforcement gets stricter every year. In 2025 and 2026 there are several developments you must know:

• New name for the cookie law: since 14 May 2024 the TTDSG has been called TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, the German Telecommunications and Digital Services Data Protection Act). It was only renamed, the cookie rule in § 25 still applies unchanged
• Higher fines: data protection authorities increasingly impose fines on small businesses too. Up to 20 million euros or 4% of annual turnover is possible
• Cease-and-desist waves: specialised law firms earn their money with GDPR warnings. Every site without a correct cookie banner is an easy target
• AI and data protection: new rules for AI-powered data processing on websites are coming

The good news: if you implement the points below, you're on the safe side.

Part 1: getting cookie consent right

The cookie banner is the first thing visitors see. And it's the most common cause for warnings. Here's how to do it right:

What a cookie banner must contain

• Clear information about which cookies are set and what for
• An equally prominent "reject" button as the "accept" button
• The ability to choose individual cookie categories, granular control
• Link to the privacy policy
• No pre-selected checkboxes: no opt-out, only opt-in

What is NOT allowed

• Dark patterns: the reject button must not be smaller or less visible
• Cookie walls: you may not make access to the website conditional on accepting cookies
• Nudging: wording like "For the best experience accept all cookies" is problematic
• Pre-loading: cookies may only be set after consent, not before

Strictly necessary vs. optional cookies

Not all cookies need consent. You can set strictly necessary cookies without consent. These include:

• Session cookies for the shopping cart
• Login cookies for the user area
• Language settings
• The cookie consent status itself

Everything else: tracking, analytics, marketing, social media, needs explicit consent.

Part 2: privacy policy

Every website needs a privacy policy. It must be reachable from every page, typically in the footer. And it must be complete and up-to-date.

What must be in the privacy policy

• Name and contact details of the controller: your name, address, email
• Data protection officer: if you have or need one
• What data you collect: IP addresses, form data, cookies, etc.
• Legal basis: why you collect the data (consent, contract, legitimate interest)
• Recipients of the data: hosting provider, newsletter tool, analytics provider, etc.
• Storage duration: how long is the data stored?
• Data subject rights: access, deletion, objection, data portability
• Third-country transfer: is data processed outside the EU? If so, on what legal basis?

Part 3: imprint

Not a GDPR topic in the strict sense, but equally important and often flawed. Every commercial website in Germany needs an imprint under §5 DDG (formerly TMG).

• Full name and address
• Email address and phone
• Commercial register and number, if applicable
• VAT ID, if applicable
• Professional details for regulated professions

The imprint must be reachable from every page with at most two clicks. A link in the footer is enough.

Part 4: contact forms and email

Every contact form on your website processes personal data. You must observe:

• Note about data processing right at the form, not just in the privacy policy
• A consent checkbox is usually not needed: if you only use the data to answer the enquiry, the enquiry itself is usually the legal basis. A clearly visible note pointing to the privacy policy is then usually enough
• Encrypted transfer: the form must run over HTTPS
• Data minimisation: only ask for data you really need. Phone number as a required field for a newsletter sign-up? Not allowed
• Deletion period: define when you'll delete the data again

Part 5: hosting and technical requirements

SSL certificate is mandatory

A website without HTTPS in 2026 isn't just an SEO problem, it's a data protection violation. Every data transfer must be encrypted. Most hosters offer free SSL certificates via Let's Encrypt.

Server location matters

Ideally, your web server should be located in the EU. If you use a host outside the EU, e.g. in the USA, you need a valid legal basis for the data transfer. The EU-US Data Privacy Framework has provided such a basis since 2023. The General Court of the EU (EuG) confirmed it on 3 September 2025, but an appeal to the Court of Justice of the EU (EuGH) is possible.

Data processing agreement (DPA)

With every service provider that processes personal data for you, you need a DPA. This affects:

• Your hosting provider
• Your email marketing provider
• Your analytics tool, if it collects personal data
• Every external tool that captures data on your website

Most reputable providers have a DPA ready that you just need to sign.

Part 6: Google Analytics and tracking

Google Analytics is the most widely used and most often misconfigured tracking tool on German websites.

Using Google Analytics 4 GDPR-compliantly

• Obtain consent: GA4 may only load after cookie consent
• IP addresses: GA4 does not store full IP addresses, and there is no longer a separate setting for this
• Disable Google Signals: this feature enables cross-device tracking and is problematic under data protection law
• Limit data retention: set to 14 months or less
• Sign DPA with Google: possible via Google Analytics settings

Alternatives to Google Analytics

If you want to play it safe, there are privacy-friendly alternatives:

• Matomo: open source, can be hosted on your own server, no cookie consent needed with the right configuration
• Plausible: lightweight, no cookies, GDPR-compliant, EU server
• Fathom: similar to Plausible, easy to use, EU server available

Part 7: social media and external embeds

Every external element on your site that sends data to third parties is data-protection-relevant:

Social media buttons

The classic like and share buttons from Facebook, Instagram & co. send user data to the platforms even before anyone clicks. The solution: Shariff or similar two-click solutions where a connection is only established after a click.

Google Maps

Google Maps embeds transmit IP addresses and usage data to Google. The GDPR-compliant solution: load Maps only after cookie consent. Show a static placeholder with a click button beforehand.

YouTube videos

YouTube videos also transmit data to Google. Use YouTube's enhanced privacy mode (youtube-nocookie.com) and load videos only after consent.

Google Fonts

Since the famous LG Munich ruling in 2022 it's clear: Google Fonts may not be loaded via Google servers without consent. The solution: host Google Fonts locally. It's easy to do and also improves load times.

Part 8: newsletter and email marketing

If you offer a newsletter, special rules apply:

• Double opt-in: mandatory in Germany. After signing up, a confirmation email must be sent
• Unsubscribe link: every email must contain a working unsubscribe link
• Logging: you must be able to prove consent: timestamp, IP, confirmed email
• Don't circumvent the coupling ban: you may not make newsletter signup a condition for a download or service

The full GDPR checklist to tick off

Here's your practical checklist. Work through it point by point:

Basics

• Imprint complete and reachable from every page
• Privacy policy complete and up-to-date
• SSL certificate active, entire site over HTTPS
• Server location in the EU or valid legal basis for third-country transfer

Cookies and tracking

• Cookie banner with equally weighted accept and reject buttons
• No cookies before consent except strictly necessary
• Granular selection of individual cookie categories possible
• Analytics tool configured GDPR-compliantly
• DPA signed with all data processors

Forms and communication

• Privacy notice on every contact form
• Consent checkbox only where it is needed (e.g. newsletter), and never pre-ticked
• Data minimisation: only necessary fields
• Newsletter with double opt-in and unsubscribe link

External services

• Google Fonts hosted locally
• Google Maps only load after consent
• YouTube videos in enhanced privacy mode
• Social media buttons as two-click solution

What happens if you don't?

The consequences are real and can get expensive:

• Fines: up to 20 million euros or 4% of annual turnover
• Cease-and-desist letters: warning costs per violation, plus legal fees
• Damages: affected individuals can demand damages
• Reputation damage: a publicly known data protection breach harms trust

In practice this doesn't only hit big corporations. Small businesses and sole traders are warned regularly, often over trivial violations like faulty cookie banners or Google Fonts not hosted locally.

Conclusion: GDPR isn't a monster: it's a checklist

Yes, the GDPR is complex. But if you treat it as a checklist instead of a threat, it's doable in one afternoon. Most points are one-offs and only need occasional updates afterwards.

And don't forget: GDPR compliance isn't only a legal duty. It's also a trust signal for your customers. Anyone who sees you handle data carefully will trust you in other areas too.

Data protection isn't an obstacle to your business. It's a quality marker.

Stefanos Svarnas, Knusperholz in Ludwigsburg. I build websites and make sure businesses get found on Google. Personally, without agency detours.

Book a first callMore about me