GDPR-proof website: cookies, forms and analytics

You need a GDPR‑compliant website. No legalese. Practical steps for three focus areas: cookies and the consent banner, forms (contact or application), and analytics. This article gives concrete settings, a checklist and a short cost estimate.

Start with the basics from the Dutch Data Protection Authority: purpose limitation, data minimisation and transparency. Their overview is concise and practical (AVG in het kort). Also read their explanation on cookies for the telecom context (Cookies en de telecomwet).

Step 1 — Do a cookie audit

List every cookie your site sets. For each cookie capture:

• name
• purpose (necessary, preferences, statistics, marketing)
• data collected (session id, IP, user id)
• storage duration
• third parties involved

Simple table to use as a template

Be realistic: if a so‑called "necessary" cookie tracks beyond session management, treat it as statistic or marketing.

Step 2 — Consent banner and management

A cookie banner is a workflow, not a UI widget. It must scan, inform, gather consent, and log it.

Practical rules:

• Show on first visit. Avoid only a "close" button that implies consent.
• Offer at least: necessary and "other cookies" or per category opt‑in.
• Store consent (timestamp, categories, banner version) for auditability.
• Block scripts until relevant consent is given.

Technical approach: use a consent‑aware tag manager or postpone script injection until consent. That prevents premature data collection.

Indicative cost: simple banner and audit €300–€1,200; complex integrations €800–€3,000 (varies by platform and third‑party tools).

Step 3 — Forms: minimise and secure

Forms often collect too much. Keep them tight.

Practical checklist:

• Only ask what you need. Remove optional fields that don’t serve immediate use.
• Do not collect special categories (health, political opinions) on generic contact forms. If you must, apply explicit additional safeguards.
• Use server‑side validation and escaping. Client‑side checks are UX only.
• Encrypt stored personal data and implement a retention schedule.
• Use anti‑spam measures (CAPTCHA or honeypot) and document them.

Security best practices align with OWASP guidance; check OWASP Top 10 for common input and authentication risks (OWASP Top 10).

Step 4 — Analytics with privacy in mind

You want insights without wrongful data collection.

Rules of thumb:

• Anonymise IPs if the tool supports it.
• Turn off features that enable User‑ID or cross‑device unless you have a lawful basis and consent.
• Shorten data retention and limit internal access.
• Only enable analytics after the user consents to statistic cookies.

Remember: technical SEO and analytics are related. Use resources like Google Search Essentials to make sure your pages remain crawl‑able and indexable while you apply privacy controls (Google Search Essentials).

Technical trade‑offs and pitfalls

• Server‑side tracking reduces third‑party exposure but increases backend complexity.
• First‑party cookies survive some browser restrictions but require proper consent handling.
• External scripts and iframes can leak data despite your cookie policy. Keep third‑party scripts to a minimum.

Quick implementation checklist

• Audit cookies and classify them.
• Implement a consent manager that blocks scripts before consent.
• Harden forms: minimal fields, server‑side validation, CSRF tokens, honeypot.
• Review analytics: anonymise, no User‑ID, set retention, load post‑consent.
• Update privacy page and link to cookie policy. See our privacy page for wording examples: /privacy.
• Prepare backup and retention documentation.
• Keep consent logs for audits.

Indicative costs: a baseline implementation €1,000–€4,000; larger projects or server‑side tracking €4,000–€12,000 depending on integrations and complexity.

Final notes

GDPR does not forbid measuring or contacting users. It forces clarity and technical discipline. If you build a new site, consider privacy‑by‑design from the start — it saves migration work later. DevCru is a senior‑led web and app development agency that builds custom sites and integrations and can help with consent management or secure form implementations. If you want to commission a site, see our options: /website-laten-maken.

If you want a short, non‑binding quote, request one at /quote.

Sources: Dutch Data Protection Authority (AVG in het kort, Cookies en de telecomwet) and security guidance (OWASP Top 10). Also see Google Search Essentials for indexing and analytics considerations.