Website privacy settings (GDPR)
Since the General Data Protection Regulation, or GDPR, took effect, many questions have arisen about what websites must do. This article offers a practical introduction rather than legal advice. If you would like BigBase to help configure your website, let us know.
The English edition retains the original publication date. Legal explanations have been clarified in October 2026; assess the requirements for your particular website with a qualified adviser.
What does the GDPR say?
The GDPR sets rules for handling personal information and gives people rights over its use. Businesses need a valid legal basis, must explain their purposes and retention periods, and must respect applicable privacy rights. Consent is one possible basis; contractual necessity and legal obligations are others. The Dutch data protection authority explains the legal bases.
Where you rely on consent, it must be valid and people must be able to withdraw it. Withdrawal does not automatically override an independent legal duty to keep particular records.
Which website components need attention?
Identify the personal data you collect, why you need it, how long you keep it and which legal basis applies. Collect only what is necessary.
A contact form is a simple example. Explain how the entered details will be used to respond to the visitor. Do not request irrelevant information, such as a birth date when it is unnecessary for answering an enquiry. A consent checkbox is not automatically required for every form: the appropriate basis depends on the purpose.
Common areas to review include:
- Google Analytics: Analytics can transmit visitor information to a provider. Review its actual configuration, cookies, sharing and transfers. Reducing or anonymising an IP address does not by itself prove that the entire process is anonymous or exempt from consent requirements. The original article described privacy settings used in BigBase websites at that time; check your current installation rather than assuming the same setup applies today.
- Facebook “Like” buttons: Embedded social widgets can contact the provider as the page loads. A simple link or a click-to-load approach can avoid loading the widget immediately. Review what happens when it is activated and provide the required information and choices.
- Google Maps: An embedded map can send information to Google. Check whether it loads before a visitor makes the necessary choice. If needed, delay loading it or use a static alternative. We can help with the configuration, or you can remove the embed through the management system.
- SSL certificates: HTTPS is an important protection for data transmitted through forms and other website features. GDPR security obligations concern the complete processing environment, including storage inside your business, rather than only the website certificate. Article 32 addresses appropriate security measures.
Common misunderstandings
”Every website must display a cookie banner”
Not necessarily. Cookie rules also come from legislation outside the GDPR. Strictly necessary cookies and certain analytics with little privacy impact are treated differently from tracking cookies. A shopping basket cookie is not automatically subject to the same consent requirement as advertising tracking. Assess the cookies and technologies you actually use. See the authority’s guidance on clear cookie banners.
”One request to use all data makes the website compliant”
A vague blanket request is insufficient. Explain the purposes, data, recipients and retention arrangements clearly. Where consent is the basis, it must cover the relevant purpose specifically. Adding a new purpose may require a new assessment and choice.
For example, an email address needed to answer an enquiry does not automatically authorise unrelated marketing. The same applies when collecting a phone number or loading maps, feeds and other third-party services. A prominent “Accept” button alone does not establish valid consent. Read the tracking-cookie guidance.
”Existing customers never need to give consent”
Being a customer does not remove privacy obligations. Some information is necessary to fulfil an order, such as a delivery address, and some records must be kept for legal reasons. Other uses need their own basis. Customer emails also require attention to the applicable marketing rules. Do not treat an earlier purchase as unlimited permission to collect or use additional details.
”If Google collects data, Google is responsible for consent”
Your website has its own responsibilities for the services it loads and the information it shares. Providers may have responsibilities too, but using a third-party product does not remove yours. Review the provider’s terms, processing arrangements and your website’s behaviour.
”reCAPTCHA is no longer allowed”
The answer depends on its implementation and data processing. Review cookies, transfers and the applicable legal basis before loading it. Form protection should remain effective when a visitor declines optional tracking. An alternative anti-spam technique may be more suitable. It is too broad to say that GDPR makes every CAPTCHA unusable.
”Other analytics are always better than Google Analytics”
Assess the configuration and data use rather than the product name alone. Different tools can have different privacy implications. Choosing a privacy-focused setup may simplify your requirements, but every provider still needs an appropriate assessment.
”I can block anyone who refuses to share data”
Consent must be freely given. A tracking-cookie wall without a reasonable alternative can undermine that freedom. Distinguish optional tracking from information genuinely needed for a requested service, such as account details needed for an account-based feature. The authority explains valid consent for tracking cookies.
”Consent lets me store a customer’s citizen service number”
The Dutch citizen service number, or BSN, is subject to specific legal restrictions. A customer’s consent alone is not sufficient to justify using it. Establish the applicable statutory authorisation and retention requirements before collecting it; do not treat approval from the customer or a general enquiry to the regulator as a substitute for that assessment.
For help reviewing the technical setup of your website, contact BigBase. Legal compliance also depends on your purposes, policies and wider business processes.