GDPR & EU Compliance for Websites

Under GDPR, a working consent banner isn’t proof of anything — the record behind it is. This guide sets out the exact GDPR consent records requirements: the fields you must log, how long to keep proof of consent (including after you delete the data), and what a supervisory authority actually asks for when a complaint lands.

Five European regulators ruled Google Analytics unlawful. The Data Privacy Framework resolved the problem they were ruling on — and left the bigger one completely untouched. Here is where GA4 actually stands under EU law today.

Most guides hand you a list of GDPR requirements and call it an audit. This one gives you the process — a repeatable, website-first method to actually run a GDPR compliance audit: how to scope it, map your data, test whether your trackers and consent banner really behave, score your gaps, and fix them. Plus a printable checklist you can run today.

In September 2025, France’s CNIL fined Google €325 million and Shein €150 million for cookie violations — in a single day. In 2025 alone, European regulators issued €1.2 billion in GDPR penalties. The rules have not changed dramatically, but the enforcement has. Here is exactly what GDPR cookie consent requires in 2026, where most websites still get it wrong, and what a compliant implementation actually looks like.

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive legal framework governing artificial intelligence. It entered into force on August 1, 2024, and is rolling out in phases through 2027.