GDPR for your website: cookies, external content, forms and privacy statement
Almost every website processes personal data: names and email addresses from a form, orders, accounts, but also IP addresses and cookies. This is covered by the GDPR (General Data Protection Regulation) and, for cookies, the Dutch Telecommunications Act. Here you can read what to look out for on your own website.
This article is not legal advice. It covers the main points as explained by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). If you're unsure about your own situation, read the AP's pages or ask an expert.
Cookies and consent
| Type | Consent required? |
|---|---|
| Functional cookies the site needs, such as a login cookie, a shopping cart or remembering the cookie choice | No, but you do need to explain them |
| Analytical cookies with little or no impact on privacy | No, if they meet the AP's conditions |
| Tracking cookies and anything that follows visitors or builds profiles, such as advertising and most embedded services from large platforms | Yes, and only load them after the visitor has given consent |
A cookie banner asks for that consent. According to the AP, you explain which cookies you use and what for, refusing is just as easy as accepting, and no boxes are ticked in advance. A banner that already loads the tracking code before the visitor makes a choice does not comply. Choose a cookie plugin that actually blocks scripts, and check this in your browser's developer tools (F12, Network tab).
Want to count visitors without a banner? Read Measuring visitors without a cookie banner.
External content
If a page loads something from another party, your visitor's browser fetches it from that party. That party then sees at least the IP address, even without cookies. So check what your site loads from outside:
- Fonts from an external service: put them on your own hosting.
- Videos: use the platform's privacy-friendly embed mode, or an image that only loads the video after a click.
- Maps: an image with a link to the map.
- Captchas, chat windows and widgets: choose a version without an external service, or only load them after consent.
- Avatars in comments go through Gravatar by default in WordPress. Turn them off if you don't need them (Settings > Discussion).
Whatever remains, you mention in your privacy statement.
Forms
- Only ask for what you need. For a callback request, a name and phone number are enough.
- Make sure your site only works over https: see Activating and renewing an SSL certificate and solving problems.
- Many form plugins also store every submission in the database, alongside the email. Set a retention period, or turn off storage if the email is enough. The log of an SMTP plugin also contains submissions.
- A newsletter signup is a separate checkbox, not ticked in advance.
The privacy statement
In your privacy statement you tell visitors, among other things:
- who you are and how they can reach you;
- which data you process, for what purpose and on what legal basis;
- who you share it with, and whether it leaves the EU;
- how long you keep it;
- what rights they have, such as access and erasure, and that they can file a complaint with the AP;
- which cookies and external services your site uses.
During installation, WordPress creates a draft Privacy Policy page and provides example texts under Settings > Privacy. That's a start, not a ready-made text. Put a link to the privacy statement in the footer and with every form. Under Tools you can export or erase a user's personal data if someone asks for it.
If you build your site with AI Builder, it can draw up a privacy statement based on what's on your site, and show a cookie banner for services from other parties. Always read the text through and add whatever is missing.
The data processing agreement with your hosting provider
If you have another party process personal data for you, such as your hosting provider, an email service or a plugin with a cloud service, that party is a processor. For this you conclude a data processing agreement. With WebOké you already have one: it's an appendix to our general terms and conditions. See Data processing agreement: where can I find it? For other services you use on your site, you arrange it with that service.
If something goes wrong, such as a hack or a leaked backup, it may be a data breach that you have to report. See Data breaches at the AP and Help! My site has been hacked. How do I fix it and how do I prevent it?
A short step-by-step plan
- Make a list of everything on your site that processes personal data: forms, accounts, orders, comments, statistics, newsletter.
- Check what your site sends to other parties when it loads.
- Remove what isn't needed and replace what can be done in a more privacy-friendly way.
- Ask for consent for whatever remains and actually requires it.
- Arrange data processing agreements and write or rewrite your privacy statement.
- Review it again every year, and after every new plugin or service.
The cookie choice on weboke.nl itself is covered in Cookies on WebOké: viewing or changing your choice. That's about our site, not yours.
Further reading at the Dutch Data Protection Authority
- Cookies: make sure you have a good policy
- Rules of thumb for clear cookie banners
- Right to information
Want to learn more? Take the free WordPress course, lesson 9.3 GDPR: cookies, forms and privacy statement.