GDPR Compliance for Your Own Store: Cookie Consent, Data Subject Rights, DPAs, and Privacy Policies
1. GDPR Fine Tiers: Why a Privacy Policy Alone Isn’t Enough
The GDPR (General Data Protection Regulation) applies to any own store serving EU users, no matter where your company is based. Fines come in two tiers: up to €10 million or 2% of global annual revenue for general violations, and up to €20 million or 4% of global annual revenue for serious violations, whichever is higher. Google was fined €50 million by Ireland’s DPC over ad tech violations, and Amazon was fined €746 million over data processing transparency.
The counterintuitive takeaway: the most common trigger for fines isn’t a badly written privacy policy, it’s a non-compliant cookie banner. Many stores load Google Analytics and Facebook Pixel scripts in the background the moment a user lands, then pop up an “Accept Cookies” window. That violates the GDPR, because analytics scripts are non-essential cookies and must wait for explicit consent before loading. For the full discussion of the compliance foundation, see The Compliance Foundation for Going Global: How to Handle GDPR, Cookies, and Cross-Border Data.
| Violation Type | Fine Tier | Typical Trigger |
|---|---|---|
| Cookies loaded without consent | Serious violation, up to €20M or 4% | GA/Pixel loaded before the banner appears |
| No “Reject” button | Serious violation | Only “Accept” and “Continue browsing” |
| Opaque privacy policy | General violation, up to €10M or 2% | Processing purposes and recipients not listed |
| Not responding to data subject requests | Serious violation | No reply to access/deletion requests within 30 days |
| No DPA signed | General violation | No DPA signed with analytics/email/CRM vendors |
2. How to Set Up Cookie Consent Management (CMP)
A cookie consent management platform (CMP) is the core compliance component. It does three things: first, it shows a cookie banner when a user lands, sorts cookies into necessary, analytics, and marketing categories, and lets the user opt in to each. Second, it doesn’t load non-essential scripts like GA, Facebook Pixel, or LinkedIn Insight Tag until the user consents to analytics. Third, it records the user’s consent choices and timestamps as evidence.
Three hard requirements: First, the “Reject” button must be as prominent as the “Accept” button — never bury rejection in a submenu. Second, no pre-checked boxes; users must opt in actively. Third, “Continue browsing” does not equal consent — never treat continued scrolling as agreement. Recommended CMP tools: Cookiebot (free tier works for small sites), OneTrust (enterprise), CookieYes (WordPress plugin). For website monitoring, see Site monitoring and alerts.
| Cookie type | Consent required | Example | What to do |
|---|---|---|---|
| Strictly necessary cookies | No | Session, cart, CSRF | Load directly, no banner |
| Analytics cookies | Yes | Google Analytics | Load only after consent |
| Marketing cookies | Yes | Facebook Pixel、LinkedIn Tag | Load only after consent |
| Functional cookies | Yes | Language preference, region selection | Load only after consent |
3. Data subject rights: a 30-day response SOP
GDPR grants EU users seven rights: access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decision-making. The ones you’ll hit most often on a standalone site are access (“show me what data you have on me”) and erasure (“delete all my data”). Both must be answered within 30 days; complex requests can be extended by two more months, but you must notify the user in advance.
Example scenario: a German user emails you asking you to delete all their data. You need to do three things: First, verify their identity (ask for their registered email and order number). Second, delete or anonymize their data across your site backend, CRM, email marketing tools, and CDN logs. Third, reply in writing confirming the deletion and list which systems you deleted data from. The whole process needs a standard SOP — don’t go hunting for data on the fly. For inquiry form reliability, see Inquiry Form Reliability the data governance article on this site.
| Right | What the user asks for | Response time limit | Action |
|---|---|---|---|
| Right of access | Show me what data you have on me | 30 days | Export user data from all systems |
| Right to erasure | Delete all my data | 30 days | Delete or anonymize across all systems |
| Right to rectification | My info is wrong, fix it | 30 days | Update CRM and order system |
| Right to object | Stop sending me marketing emails | Immediately | Unsubscribe from email list, flag objection |
| Right to data portability | Export my data for me | 30 days | Export in machine-readable format |
4. DPAs and privacy policy: two documents you can’t skip
A DPA (data processing agreement) is a contract you sign with every third party that processes EU user data. Common third-party processors for standalone sites include: Google Analytics, Google Tag Manager, Mailchimp/SendGrid email tools, Stripe/PayPal payment gateways, HubSpot/Salesforce CRM, and CDN providers. You must sign a DPA with each one, confirm they handle data to GDPR standards, and list their sub-processors.
A privacy policy isn’t something you copy from a template site and call it done. It has to cover: who the data controller is, what data you process, why you process it, who receives it (name names like Google and Stripe), how long you keep it, what rights users have, how to exercise those rights, and a DPO or contact details. Write it in plain language, not pages of legal jargon. Layer it: a summary on the main page, the details on a subpage. For website accessibility, see Website accessibility (WCAG).
| Third parties | Data Type | DPA available? | Notes |
|---|---|---|---|
| Google Analytics | Behavioral data | Signable in Google’s dashboard | Requires IP anonymization |
| Stripe/PayPal | Payment data | Standard payment processor DPA | No separate negotiation needed |
| Email marketing tools | Email and subscription data | Signable in the tool’s dashboard | Must list subprocessors |
| CRM (HubSpot, etc.) | Customer and inquiry data | Signable on Enterprise | Free-tier DPA is incomplete |
| CDN (Cloudflare, etc.) | Log data | Standard DPA | Confirm log retention period |
5. How small teams get it done: four steps
Small teams shouldn’t try to do all their GDPR compliance work at once. Take it in four steps. Step one: install a CMP and set up your cookie categories and script deferral. Step two: sign DPAs with every third party and keep a list of your data processors. Step three: write a plain-language privacy policy that discloses everything required. Step four: build an SOP for data subject requests, covering identity verification, deletion across systems, and written replies.
Mistakes to avoid: First, using “by continuing to browse” as consent, which is a violation. Second, loading analytics scripts before the banner appears, the single most common trigger for fines. Third, copying your privacy policy from a template site without stating specific processing purposes and recipients. Fourth, not being able to find where a user’s data lives when they send a deletion request, because you have no data asset inventory. Fifth, transferring EU data to servers in China without Standard Contractual Clauses (SCCs); cross-border data transfers need a lawful mechanism. For backup and recovery, see Backup and recovery drills for your site.
| Stage | Action | Output | Suggested timing |
|---|---|---|---|
| Step one | Install a CMP and set up cookie categories | Compliant cookie banner | 1 week |
| Step two | Sign DPAs with all third parties | Data processor list | 2 weeks |
| Step three | Write a privacy policy | Layered privacy policy page | 1 week |
| Step 4 | Build a data request SOP | 30-day response process document | 1 week |
FAQ
What’s the maximum GDPR fine, and when do you get fined?
Must a cookie banner have a reject button, and can it be hidden in a submenu?
When does the Google Analytics script load?
How fast do I have to respond when a user asks me to delete their data?
What is a DPA, and who do I sign one with?
How does a small team get started with GDPR compliance?
Final thoughts
GDPR compliance isn’t about how polished your legal documents look. It’s about what you do on the technical side: cookies don’t load in advance, consent is logged, third parties have signed DPAs, and user requests follow an SOP. Plenty of sites have a privacy policy dozens of pages long, yet their GA script fires before the banner appears. That’s where the fines actually come from.
Four steps to get it done: set up a CMP with your cookie categories, sign DPAs with every third party, write a plain-language privacy policy, and build an SOP for responding to data requests within 30 days. Small teams shouldn’t try to do everything at once. Fix cookie consent first, since that’s where the most fines come from.
One line worth remembering: GDPR compliance isn’t about writing a privacy policy. It’s about making sure your site doesn’t sneak in a single non-essential cookie before the user says “no.”