What it is

The explanation

The GDPR is the European privacy law governing what you may do with personal data. For a website it comes down to three things: what you collect through forms, what you measure with analytics, and which parties get to see data about your visitors in the process.

An IP address is personal data. That is why apparently innocent things — a font loaded from an external server, an embedded video — already fall under it.

Why it might matter to you

4 points
  • A cookie banner is only required if you set cookies that are not strictly necessary. If you set none, you need no banner — and it is better not to show one.
  • A privacy statement has to name which parties process data, not describe in general terms that you are careful.
  • Google Analytics, embedded video and external fonts all send your visitor’s IP address to a third party. That belongs in the statement.
  • You have to be able to say how long you keep data. "As long as necessary" is not an answer.

How we handle it

In practice

This site sets no cookies at all and therefore has no banner. The typeface is served from our own domain rather than Google’s, precisely because otherwise every visitor’s IP address would go to a third party. That is why our privacy statement lists three processors rather than four, and why every line in it can be checked.

Related terms

3 pages

Hosting

Hosting is where your site lives. What separates the types, and why it has to be in your name.

Read more →

Conversion

Conversion is the share of visitors who do what you want. What a normal rate looks like and why more traffic is rarely the answer.

Read more →
Next step

Not sure which way to go?

Send a short brief with what you have now and what needs to be better. You get an honest answer, including if that answer is that you do not need us for it.