Skip to main content
Zumaquero Dev.
← Blog

Your website doesn't meet GDPR or LSSI-CE: the 5 most common failures

The five legal compliance mistakes that come up most often on small business and freelancer websites, and how to fix them without making your life complicated.

6 min read
GDPRLSSI-CELegal complianceCookies

I have reviewed enough small business and freelancer websites to know that non-compliance is almost never intentional. It is a template that ships with Google Analytics by default, a contact form nobody reviewed, a legal notice copied from another site three years ago. The problem is that the AEPD (the Spanish Data Protection Agency) does not care about intent: what it penalises is the fact.

This is not an exhaustive legal guide —that is what your advisor or a specialist lawyer is for—, it is the list of what I run into again and again when I review a website from a technical point of view.

GDPR (the EU's General Data Protection Regulation) and LSSI-CE (Spain's Law on Information Society Services and E-commerce) are not paperwork separate from web development: they are implemented in the code itself. A badly programmed cookie banner, an analytics script that fires too early or a form without proper validation are, at the same time, technical faults and legal breaches. That is why this is as much for me to review as for a lawyer.

It is by far the most common. Many templates and many developers load Google Analytics, the Meta Pixel or any similar tool straight into the <head>, with no condition at all. The result: the cookie is set in the user's browser before they have said yes to anything.

<!-- Wrong: the tag runs as soon as the page loads -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() {
    dataLayer.push(arguments);
  }
  gtag("js", new Date());
  gtag("config", "G-XXXXXXX");
</script>

The right way is not to load the script until the user has accepted, and to respect their choice if they refuse:

<!-- Right: the script is only injected after consent -->
<script>
  function loadAnalytics() {
    const script = document.createElement("script");
    script.src = "https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX";
    script.async = true;
    document.head.appendChild(script);
  }
 
  if (localStorage.getItem("analytics-consent") === "accepted") {
    loadAnalytics();
  }
</script>

This example is deliberately simple; in production it is best to rely on a consent management platform (CMP) and, if you use Google, on its Consent Mode. The underlying idea is the one that matters: nothing that is not strictly necessary for the site to work is loaded without explicit permission.

LSSI-CE (article 10) requires any website with economic activity to clearly identify its owner: name or company name, tax ID, address, contact email and, where applicable, registration details or professional registration number. It is surprisingly common to find sites with no legal notice, with a generic one copied from another company, or hidden in a footer link nobody keeps up to date.

It does not need to be long or sophisticated: it needs to be correct, complete and real.

Any form that collects personal data —contact, newsletter, quote request— needs to clearly and accessibly inform people about what is done with that data, and needs an explicit act of consent when that is the basis for processing (fine print saying "by submitting this form you accept..." is not enough). What I see most often:

  • Forms with no link at all to the privacy policy.
  • A GDPR checkbox that exists visually but does not block submission if it is left unticked (the JavaScript does not validate it).
  • Pre-ticked boxes, which are not valid as consent under GDPR: consent has to be a positive action by the user.

For years the banner with a big "Accept" button and no visible way to refuse other than closing the tab worked fine. Not any more. The AEPD's cookie guidance makes clear that refusing must be just as easy as accepting: the same number of clicks, the same visibility, with no need to dig into a settings submenu to find the "no". A banner that only has an "Accept" button (or where "Accept" is a big button and "Refuse" a tiny grey text link) is non-compliant, even if the option technically exists.

"Continuing to browse implies acceptance" is no longer valid either: browsing is not a valid act of consent.

Failure 5: data processors with no contract (hosting, email marketing, CRM)

This is the least visible failure and the one most often forgotten. Any external supplier that processes personal data on behalf of your company —hosting, email marketing tool, CRM, form gateway, analytics service— is, in GDPR terms, a data processor. The regulation requires a data processing agreement (GDPR article 28) that governs what that supplier can do with the data, for how long and what security guarantees it offers.

Most serious suppliers (professional hosting, transactional email platforms, well-known CRMs) already offer you that contract, often built into their terms of service or downloadable from their dashboard. The usual failure is not that the supplier does not offer it, it is that nobody has signed or filed it.

How to tell whether your website has any of these failures

Without specialist tools, you can check the most obvious things yourself:

  • Open the browser developer tools ("Network" tab), reload your site without accepting cookies and check whether third-party scripts are already loading.
  • Find your legal notice and check it has a real tax ID, address and contact details.
  • Fill in your own contact form without ticking the GDPR checkbox (if you have one) and check whether submission is actually blocked.
  • Check whether your cookie banner has a refuse button as visible as the accept one.

What to do from here

None of these five failures is hard to fix in isolation; what usually happens is that several pile up at once because nobody has reviewed them since the site launched. If you want to know where yours stands, I review these points (along with performance, technical SEO and security) in the free assessment.

And even if you fix them all today, the rules do not stand still: a monthly maintenance plan is exactly how this review stops depending on someone remembering to repeat it a year from now.

Who takes care of this on your website month to month?

Monthly maintenance includes keeping an eye on exactly this kind of legal and technical compliance, not just making sure the site stays up.

See maintenance plans