Most small business owners only think about GDPR and CCPA when a customer asks "what do you do with my data" or a cookie consent plugin throws an error. A privacy policy is not optional paperwork. It is the one page on your website that tells regulators, payment processors, and visitors from the EU, UK, and California exactly how you collect and use personal information, and getting it wrong can mean fines, lost ad accounts, or a payment processor freezing your account.
This guide breaks down what GDPR and CCPA actually require from a small business website, in plain English, without the legalese.
What GDPR actually requires from a small website
GDPR applies to you if EU or UK visitors can buy from, sign up on, or be tracked by your site, even if your business is based in the US, Canada, or Australia. The regulation does not care where your company is registered; it cares where your visitors are.
At a minimum, your privacy policy needs to state:
- What personal data you collect (name, email, IP address, payment details, cookies)
- Why you collect it (the "legal basis", usually consent or a contract you need to fulfil)
- How long you keep it
- Whether you share it with third parties (payment gateways, email tools, analytics)
- How a visitor can request their data be deleted or corrected
GDPR also requires active cookie consent before you load tracking cookies, not just a banner that says "by using this site you agree." The visitor has to click something before Google Analytics or Meta Pixel fires. A cookie consent banner generator that blocks non-essential cookies until the visitor opts in is the easiest way to get this right without hiring a developer.
What CCPA (and CPRA) requires
The California Consumer Privacy Act, updated by the CPRA, applies if you do business with California residents and meet revenue or data-volume thresholds, but many small sites add the disclosures anyway because California traffic is hard to avoid and the rules overlap heavily with GDPR.
CCPA gives California residents the right to:
- Know what personal information a business has collected about them
- Request that information be deleted
- Opt out of the sale or "sharing" of their personal information
- Not be discriminated against for exercising these rights
If your site uses ad trackers that share browsing data with Google or Meta for retargeting, CCPA generally treats that as "sharing," which means you need a "Do Not Sell or Share My Personal Information" link, usually in the footer.
GDPR vs CCPA: the quick comparison
| GDPR (EU/UK) | CCPA/CPRA (California) | |
|---|---|---|
| Who it covers | Any site with EU/UK visitors | Businesses meeting revenue/data thresholds serving CA residents |
| Consent model | Opt-in before tracking | Opt-out of sale/sharing |
| Core visitor rights | Access, correction, deletion, portability | Know, delete, opt out, non-discrimination |
| Cookie banner needed | Yes, active consent | Usually, with an opt-out link |
| Typical penalty | Up to 4% of global revenue or €20M | Civil penalties plus private right of action for breaches |
| Applies regardless of your location | Yes | Yes, if you serve CA residents |
What this actually means for your website
Most small business sites need the same handful of things regardless of which law technically applies, because building one compliant policy is simpler than maintaining two:
- A real, specific privacy policy page, not a generic template copied from another site. It should list your actual tools: your website builder, email provider, payment processor, and any analytics you run. A GDPR-ready privacy policy generator can produce a page tailored to the tools you actually use in a few minutes.
- A cookie consent banner that blocks analytics and ad pixels until the visitor consents, with a working "reject" option that is just as easy to click as "accept."
- A visible contact method for data requests, usually an email address like privacy@yourdomain.com.
- Clear disclosure of third parties, especially your payment gateway and any email marketing tool, since both handle personal data on your behalf.
- A "Do Not Sell or Share" link in the footer if you run any retargeting ads.
None of this requires a lawyer for most small sites, but it does require your privacy policy to match what your site actually does. A policy that says "we do not use cookies" while Google Analytics is running is worse than having no policy at all, because it is a provable false statement.
Common mistakes small business sites make
- Copying a competitor's privacy policy word for word, including clauses that do not apply to the business
- Loading analytics and ad pixels before the visitor accepts cookies
- Burying the privacy policy link somewhere visitors cannot find it (it should be in the footer on every page)
- Never updating the policy after adding a new tool, like a live chat widget or a new payment provider
- Treating GDPR as "an EU problem" when the business ships internationally or runs ads that reach EU audiences
Where this fits if you are selling into multiple countries
If you are building or growing a presence in the UK, United States, or other markets with their own data rules, it is worth treating privacy compliance as part of your overall website setup rather than an afterthought bolted on later. The same applies to basic security hygiene; see our guide on website security basics for the broader picture of protecting customer data beyond just the privacy policy page.
A website that is AI-built with a managed host, free SSL, and the right compliance pages baked in from the start saves you from retrofitting all of this later under pressure from a regulator email or a payment processor review.