Low-maintenance privacy policies for your website

Mandatory information under Art. 13 GDPR

When data is collected from visitors themselves, the controller must provide information at the time of collection (Art. 13 GDPR). On a website, that means with the first page view at the latest. In particular, the privacy policy states:

• the name and contact details of the controller and, where applicable, of the data protection officer and an EU representative
• the purposes and legal bases of each processing operation and, for legitimate interests, those interests
• the recipients or categories of recipients
• transfers to third countries and their basis
• the retention period or the criteria for it
• the rights of visitors, including withdrawing consent and lodging a complaint with the supervisory authority

Recipients: categories or names?

Art. 13(1)(e) GDPR requires “the recipients or categories of recipients”. Categories such as “hosting providers” therefore satisfy the wording. The supervisory authorities’ transparency guidelines (WP 260, endorsed by the EDPB), however, treat naming the actual recipients as the default and require categories to be as specific as possible. The right of access is stricter: on request, the actual recipients must in principle be named (CJEU, judgment of 12 January 2023, C-154/21).

A hybrid structure combines both: the text names the categories, and an annex lists the providers actually used. The text stays stable, and the provider list stays complete.

Privacy policy and cookie banner

Two sets of rules apply side by side. The GDPR governs the processing of personal data. Access to the user’s device, meaning setting and reading cookies and similar technologies, is governed by the ePrivacy rules (Art. 5(3) ePrivacy Directive, in Germany § 25 TDDDG), regardless of whether personal data is stored. Consent is required unless the access is strictly necessary to provide a service explicitly requested by the user.

The banner therefore typically obtains both consents together. The privacy policy describes the processing operations and the types of consent. The cookie information with the name, purpose and duration of individual cookies belongs in the consent tool. What matters is that banner and website match: if a service already loads before consent, even the best text will not help.

When does the policy need updating?

The policy must reflect the actual state of the website. Typical reasons for an update are:

• new features such as a newsletter, shop, customer account or chat
• new or changed service providers, for example for hosting, analytics or payments
• newly embedded content such as videos, maps or fonts
• changed retention periods or a new data protection officer
• changes in the law, for example on international transfers

Common mistakes

These weaknesses come up particularly often in practice:

• a copied policy that does not match your own technology
• forgotten services, especially embedded fonts, maps, videos and captchas
• analytics and marketing tools that load before consent
• providers that were replaced long ago, while new ones are missing
• blanket legal bases not assigned to the individual purposes
• a vague retention period such as “as long as necessary” without criteria
• processors named in the policy without an agreement under Art. 28 GDPR

US services and the Data Privacy Framework

Many website services come from US providers, for example for analytics, advertising or videos. Since the European Commission’s adequacy decision of 10 July 2023, data may be transferred to US companies certified under the EU-US Data Privacy Framework (DPF). The privacy policy must still mention the transfer and its basis (Art. 13(1)(f) GDPR).

Without certification, or if the recipient is in another third country without an adequacy decision, standard contractual clauses are usually required. The public DPF list shows whether a provider is certified. The status can change and should be checked regularly.

Warning letters and fines

A missing or incorrect privacy policy breaches the information obligations. Supervisory authorities can impose fines of up to EUR 20 million or 4% of worldwide annual turnover under Art. 83(5)(b) GDPR. Data subjects can lodge complaints and, under the conditions of Art. 82 GDPR, claim damages.

Whether competitors can take action against data protection breaches was disputed for a long time. The CJEU has ruled that the GDPR does not preclude competitors from suing under national unfair competition law (judgment of 4 October 2024, C-21/23). Cases where the text and the website clearly diverge, such as tracking without consent, are particularly exposed.

Placement and accessibility

The policy must be easily accessible (Art. 12(1) GDPR). Proven practice includes:

• a clearly labeled link such as “Privacy” on every page, usually in the footer
• a reference where data is collected: contact form, newsletter sign-up, checkout and cookie banner
• a separate page, not hidden in the imprint or the terms and conditions
• the language of the website: if you address English-speaking visitors, offer the policy in English too