GDPR
Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data
Key Facts
Overview
The GDPR is the world's most influential data protection regulation, setting the baseline standard that most other countries' privacy laws follow. Enacted by the European Union in 2016 and enforceable since May 2018, it governs how any organization worldwide must handle personal data of people in the EU and EEA.
What This Means for Your Website
- You must show a consent banner to EU/EEA visitors before loading any non-essential cookies or tracking scripts
- Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes do not count
- Visitors must be able to withdraw consent as easily as they gave it
- You need granular consent categories (analytics, marketing, functional) — a single "Accept all" is insufficient
- A visible "Reject all" option must be as prominent as "Accept all"
- You must keep auditable records of when and how each visitor consented
- Privacy by design requires data protection to be built into your systems from the start
Key Requirements
The GDPR applies extraterritorially to any website processing personal data of EU/EEA residents. Penalties reach EUR 20 million or 4% of global annual turnover, whichever is higher. Each EU member state has a national Data Protection Authority (DPA) that enforces the regulation locally, coordinated by the European Data Protection Board (EDPB). Data subject access requests must be fulfilled within one month. Data Protection Impact Assessments are required for high-risk processing activities.
How ConsentStack Handles This
ConsentStack automatically detects EU/EEA visitors via geo-location and presents a GDPR-compliant opt-in consent banner. All non-essential scripts are blocked until the visitor actively consents through granular category toggles. Consent records are stored with timestamps and preference details for audit compliance, and consent is automatically re-collected after 12 months per regulatory guidance.
Penalties
Up to EUR 20 million or 4% of global annual turnover, whichever is higher
Key Requirements
- Prior opt-in consent required for non-essential cookies
- Granular consent by purpose category
- Consent withdrawal must be as easy as giving consent
- Records of consent must be maintained for audit
- Privacy by design and by default
- Data Protection Impact Assessments for high-risk processing
Notable Provisions
- Extraterritorial scope applies to non-EU organizations targeting EU users
- One-stop-shop mechanism for cross-border enforcement
- Right to be forgotten under Article 17
Data Subject Rights
Right to obtain confirmation of whether personal data is being processed and access to that data
Right to have inaccurate personal data rectified or completed
Right to have personal data erased when no longer necessary or consent is withdrawn
Right to restrict processing of personal data in certain circumstances
Right to receive personal data in a structured, commonly used, machine-readable format
Right to object to processing based on legitimate interests or for direct marketing purposes
Other Europe Regulations
Frequently Asked Questions
Do I need a cookie banner for GDPR compliance?
Yes. The GDPR requires explicit opt-in consent before placing any non-essential cookies or tracking scripts on visitors from the EU/EEA. ConsentStack automatically shows a compliant consent banner to EU visitors.
What are the GDPR penalties for cookie non-compliance?
Fines can reach EUR 20 million or 4% of global annual turnover, whichever is higher. National data protection authorities in each EU member state enforce these penalties.
Does GDPR apply to websites outside the EU?
Yes. The GDPR applies to any website that processes personal data of EU/EEA residents, regardless of where the website operator is based. This extraterritorial scope means most global websites need GDPR-compliant consent.
How long is GDPR cookie consent valid?
The GDPR does not specify an exact duration, but supervisory authorities like the ICO and CNIL recommend re-collecting consent at least every 12 months. ConsentStack supports configurable consent expiry periods.
Stay compliant with GDPR
ConsentStack helps you implement Opt-in consent for European Union + EEA automatically.