Bloggers tend to land in one of two camps. Either they ignore GDPR entirely, which is risky, or they install one of those screen-blocking consent banners that ruin the reading experience for every visitor, which is overkill for most small sites. A middle ground genuinely exists: compliant, low-friction, and it doesn’t require legal training to set up. This post walks through that middle ground.

Disclaimer: This is practical guidance, not legal advice. For specific situations, consult a lawyer. That said, most blogs are well-served by the general patterns below.
GDPR compliance decision flow for bloggers showing what triggers consent requirements

What GDPR actually applies to

GDPR is European law that protects the personal data of EU residents. It applies to:

  • Any blog with EU visitors, regardless of where the blog itself is hosted.
  • Any tool that processes personal data, including analytics, email lists, comments, and embeds.

If you have a global audience, it’s safest to assume GDPR applies to you. The penalties are genuinely real: the upper tier of fines can reach €20 million or 4% of a company’s global annual turnover, whichever figure is higher, though enforcement against small hobbyist blogs specifically is rare (GDPR Article 83, “General conditions for imposing administrative fines”).

What triggers the need for consent

Not everything does. The trigger is processing personal data with cookies or trackers that aren’t strictly necessary for the site to function.

Strictly necessary cookies that don’t need consent:

  • Session cookies for login.
  • Cart cookies for shopping.
  • Cookies that remember a language preference.
  • Security cookies, such as CSRF protection.

Non-essential cookies that do need consent:

  • Analytics tracking, including most GA4 implementations.
  • Advertising cookies.
  • Social media embed cookies.
  • Third-party fonts that log requests, which sometimes includes Google Fonts.
  • Personalization cookies.

The underlying principle: if a cookie or tracker can identify a visitor or track them across sites, it needs consent first. The UK’s ICO publishes detailed, regularly updated guidance on exactly which categories fall into which bucket, and it’s worth bookmarking directly (ICO, “Cookies and similar technologies”).

The simplest compliant setup

The lowest-effort way to reach compliance looks like this:

  1. Use privacy-friendly analytics such as Plausible or Fathom. No cookies means no consent requirement, and our guide to privacy-friendly analytics for bloggers compares the main options in more depth.
  2. Self-host your fonts, which is covered in our fonts comparison post. This eliminates Google Fonts data sharing entirely.
  3. Avoid third-party embeds with autoplay, such as Facebook video or Twitter feeds, or use lazy-loading with consent instead.
  4. Add a privacy policy page describing what you collect and why you collect it.
  5. Add a cookie policy page if you run any non-essential cookies at all.

With this setup in place, you may not need a consent banner at all. The blog runs without tracking, the policy pages cover what you do collect (email signups and similar), and EU readers face no friction when they land on the site.

If you keep Google Analytics or ads

In that case, you’ll need the following in place:

  • A consent banner that loads before any tracking scripts fire.
  • An option to decline, which some jurisdictions require to be the default state.
  • Granular consent, separating analytics from marketing, which is generally preferred.
  • A way for visitors to change or revoke their consent later.

A few tools handle this well for WordPress:

  • Complianz. The free, self-hosted tier is uncapped and works well for most bloggers. It auto-configures based on what’s actually running on your site, with premium plans starting around $59 a year if you need more.
  • CookieYes. Offers a free plan for smaller sites with a monthly pageview cap, with paid plans starting around $10 a month per domain once you outgrow it.
  • Cookiebot. The most comprehensive option, but pricing has climbed substantially in recent years, which makes it a harder sell for hobbyist blogs than it once was.

Set up the plugin once, but don’t trust its defaults blindly. Some plugins load too aggressively or fail to block scripts properly out of the box. Test by visiting your own site in a fresh, private browser window and watching the network requests that fire before you interact with anything.

A non-intrusive cookie consent banner at the bottom of a blog with accept and decline options

What a good consent banner looks like

  • Small. A bottom bar or corner box works well; avoid a full-screen takeover.
  • Clear options. “Accept all,” “Accept essential only” (or “Decline”), and optionally “Customize.”
  • Decline as easy as accept. Buttons should be the same size, with no manipulative design tricks.
  • Doesn’t block content. A visitor should be able to read the page without interacting with the banner at all.
  • Loads fast. Heavy consent banners can noticeably hurt page speed.

What to avoid entirely:

  • A full-screen modal that requires an action before the visitor can proceed.
  • Pre-checked “accept all” boxes.
  • A “decline” option hidden inside a sub-menu.
  • Banners that reappear on every single page load.

Several regulators, France’s CNIL especially, have fined sites specifically for these “dark pattern” cookie banners, and the ICO’s current guidance requires “Accept all” and “Reject all” to carry equal visual prominence.

Email lists and GDPR

Collecting emails carries its own set of rules:

  • Consent must be explicit. Pre-checked signup boxes aren’t allowed under GDPR.
  • The signup must be for a specific purpose. “Sign up for my newsletter about X” works fine. A bare “sign up” with no context doesn’t.
  • The visitor must be able to unsubscribe easily. Every email needs a working unsubscribe link.
  • Double opt-in is recommended. Sign-up triggers a confirmation email, and only confirmed addresses go onto the list. This reduces fake signups and strengthens your consent record.

Modern email tools like MailerLite and ConvertKit handle this by default. Resist the urge to disable their compliance features just to “boost conversion” numbers, since it undermines the consent you’re relying on.

Comments and GDPR

If you allow comments, you’re collecting personal data such as email addresses, IP addresses, and usernames. You need:

  • A clear notice that commenting stores this data.
  • A way for commenters to request deletion of their data.
  • A mention of this in your privacy policy.

WordPress’s default comment form includes a checkbox for “Save my name, email…” that helps satisfy consent requirements. Leave it in place rather than removing it.

Embeds and third-party content

YouTube embeds, Twitter embeds, Instagram embeds, and similar widgets all set cookies before the visitor ever interacts with them. That means they count as third-party tracking under GDPR.

Two approaches work well here:

  • Lazy-load with consent. Show a placeholder, and only load the embed once the visitor clicks “load embed” or has already accepted cookies.
  • Use privacy-respecting alternatives. The youtube-nocookie.com domain works for YouTube, and similar no-cookie versions exist for some other services.

Most WordPress block embed handlers aren’t privacy-aware by default. A plugin such as “Embed Privacy” can help close that gap.

The privacy policy page

Quick tip: WordPress ships a privacy policy template under Settings, then Privacy, inside every install. Start there rather than writing one from a blank page.

Every blog needs a privacy policy page. It should include:

  • What data you collect: email addresses, comments, analytics, IP addresses, and so on.
  • Why you collect each type of data.
  • Who you share it with, such as your email tool or analytics provider.
  • How long you keep it on file.
  • How visitors can request deletion or access to their own data.

Customize the built-in WordPress template for your specific tools rather than leaving it generic. Most consent plugins also include their own policy generators if you’d rather start there.

The cookie policy page

If you run any cookies at all, you should have a cookie policy explaining what they do. This is often included as a section inside the privacy policy rather than as a separate page, and it should list:

  • Each cookie or category of cookies you use.
  • Its purpose.
  • Its duration.
  • Whether it’s first-party or third-party.

Our broader post on disclosure, privacy, and legal pages every blog needs covers how this fits alongside the other legal pages a blog should have in place.

What about CCPA, LGPD, and other laws

California’s CCPA, Brazil’s LGPD, and similar laws elsewhere have come into effect in recent years. The underlying patterns are similar to GDPR:

  • Disclose what you collect.
  • Allow users to opt out.
  • Provide deletion on request.

A blog that’s GDPR-compliant is largely compliant with these too. The main add-on for CCPA is a “Do Not Sell My Personal Information” link if you actually sell data, and most bloggers don’t, so this often simply doesn’t apply.

If your site runs on Aurora, none of this compliance work touches the theme itself. GDPR and cookie consent live entirely at the plugin and content level, so switching to privacy-friendly analytics or adding a consent banner won’t conflict with your layout or customizer settings.

Compliant without the friction

GDPR isn’t as scary as the legal-industry version of it suggests, but it’s also not something you can safely ignore. The simplest path forward: switch to privacy-friendly analytics, self-host your fonts, write basic privacy and cookie policies, use double opt-in for emails, and either avoid heavy third-party trackers or use a consent plugin like Complianz. The “huge consent banner everywhere” approach is mostly avoidable for a typical blog. The “ignore it and hope” approach mostly isn’t.