Since the GDPR (General Data Protection Regulation), running a website in Europe comes with privacy obligations – and ignoring them risks warning letters, fines and trouble with regulators. For SMBs this is often a blind spot: the website was set up once and runs – but whether it is actually compliant, no one really knows.
I'll show you nine typical GDPR mistakes on the websites of small and mid-sized businesses – and how to fix them.
Note: this article is not legal advice. For specific legal questions, consult a specialist data-protection lawyer. The measures are technical and organisational recommendations (as of October 2026).
Google Fonts loaded via external servers
The problem: many websites load Google Fonts directly from Google servers (fonts.googleapis.com). This sends every visitor's IP address to Google without consent. In its judgment of 20 January 2022 (case no. 3 O 17493/20), the Munich Regional Court I (LG München I) held this to be a data-protection violation, granted an injunction against the website operator and awarded the plaintiff damages. A wave of warning letters followed.
How to do it right: host the fonts locally, i.e. store them on your own server and load them from there. Visually, nothing changes. Also check themes and plugins (design templates and extensions) that load Google Fonts on their own.
Cookie banner missing or wrongly configured
The problem: Section 25 TDDDG (the German Telecommunications Digital Services Data Protection Act; in force since 1 December 2021, called TTDSG until May 2024) requires consent before your website stores or reads anything on the visitor's device: cookies, local storage (storage in the browser), tracking pixels (invisible counting images). The only exception is what is strictly necessary for the service the visitor asked for. A pre-selected “accept all” is not valid consent.
What helps: a consent management tool (it asks for and records consent) such as Cookiebot, Usercentrics or Borlabs Cookie that only starts tracking after consent. “Reject” must be as easy as “Accept” on the very first layer – that is the position of the Datenschutzkonferenz (the German data-protection authorities' conference), confirmed by several courts.
You can do without a banner if your website only uses technically necessary cookies or storage (e.g. for language, login or shopping cart) and no tracking or marketing tools.
Missing or outdated privacy policy
The problem: the GDPR requires a complete privacy policy that describes every processing activity: contact form, cookies, analytics, hosting provider, newsletter, ordering systems. Not having one – or using a 2018 version – violates the GDPR.
Better: a current, complete privacy policy – reviewed by a data-protection lawyer or created with a reputable generator like activeMind Legal or Dr. Schwenke. Update it with every new tool or form.
Google Analytics without proper integration
The problem: Google switched off Universal Analytics in 2023; today there is only GA4 (Google Analytics 4). GA4 also sets cookies and may only load after consent. The transfer to the US has been covered by the Data Privacy Framework since 2023 (see pitfall 08); that does not change the consent requirement.
Two clean options: start GA4 via your consent management only after consent – or switch to a privacy-friendly analytics tool without tracking cookies on EU servers, which, depending on the setup, works without consent. For many small businesses, simple visitor numbers are enough to see whether their visibility on Google is growing.
No data processing agreement (DPA) with the host
The problem: running your website on a hosting provider means data (visitor IPs, log files) is processed on your behalf. The GDPR requires a DPA for this – a contract that sets out how the provider may handle the data. Many companies never signed one.
What to do: sign a DPA with your hosting provider. Reputable German providers (IONOS, Hetzner, Strato and others) offer one, often online in a few clicks.
Contact form without a privacy notice
The problem: if you collect personal data through a form (name, email, phone), you must inform users how it will be processed. A form without a privacy notice is non-compliant.
How it works: every form needs a link to your privacy policy and a short note on what you use the data for. You mainly need a checkbox if you want to use the data beyond the enquiry, e.g. for a newsletter. Encrypted transmission (https), and store data only as long as necessary.
Embedded YouTube videos without consent
The problem: standard YouTube embeds connect to Google and set cookies as soon as the page loads – even if nobody clicks play. Without consent that's not allowed.
Safer: load videos only after a click (click-to-play); until then the page shows just a locally stored preview image. YouTube's “privacy-enhanced mode” (youtube-nocookie.com) still transfers data to Google and is not enough on its own. Alternatively: host the videos yourself.
Hosting on US servers without safeguards
The problem: many US hosts and CDNs (networks that deliver content worldwide) process data in the US. The CJEU struck down the former Privacy Shield in 2020 (Schrems II). Since 10 July 2023, the European Commission's adequacy decision on the EU-US Data Privacy Framework (DPF) applies: transfers to DPF-certified US providers are permitted again. Whether the decision will last is open – it has already been challenged in court.
What I recommend: check whether your US provider is on the official DPF list, and sign a DPA. Without certification you need standard contractual clauses (EU model contracts). Simpler: a German or European host with a DPA (e.g. IONOS, Hetzner, netcup, Strato).
Missing or wrong imprint
The problem: not GDPR but almost as important: the imprint (legal notice). Mandatory details are full name/company, address, phone, email and, where applicable, company register number, VAT ID and responsible person. Since 14 May 2024 this has been governed by Section 5 DDG (German Digital Services Act) instead of the Telemedia Act (TMG). Violations can lead to warning letters.
In practice: fill in the imprint completely, reachable in at most two clicks from any page. Replace “§ 5 TMG” in the text with “§ 5 DDG”. Update it after a move or a change of legal form.
GDPR quick check: self-test for your website
- Google Fonts hosted locally (not via fonts.googleapis.com)?
- Cookie banner with an equivalent “Reject” – or no tracking tools at all?
- Privacy policy current, complete and reachable from every page?
- Google Analytics 4 (if used) only active after consent?
- DPA signed with your hosting provider?
- Contact form with a privacy notice and encrypted (https)?
- YouTube videos loaded only after a click?
- Hosting in the EU or with a DPF-certified US provider?
- Imprint complete, correct (§ 5 DDG) and easy to find?
If you can answer yes to all nine, your website's data protection is at a solid level. If not: most points can be fixed in a few hours.
Conclusion
GDPR compliance is not a one-off project: when case law, tools or your website change, it has to be reviewed again. For SMBs without an internal IT department or data protection officer, I recommend two things: a website where data protection is built in from the start, and a data-protection lawyer for specific legal questions.
At Klarspur, data protection is part of the website from the start: every website I build and maintain runs on servers in Germany, loads its fonts locally and comes with a legal notice and a privacy policy.