Consent Proof for Small Sites: The Minimum Record That Actually Holds Up
Most consent guidance is written for companies with a legal department, which leaves the small site owner, the bakery, the consultancy, the niche shop, to conclude the whole subject is beyond them and do nothing. That conclusion is the worst available option. The distance between nothing and a defensible basic setup is a weekend of work with ordinary tools, and the core of it is record keeping, not technology.
This article defines the minimum viable consent setup for a small site: the configuration defaults that matter, the small set of records to keep, and the change your mind path that most small sites forget entirely. It also names the upgrades worth buying later, when traffic or regulators justify them, so you can stop buying them now.
The configuration defaults that do the legal work
Three defaults carry most of the weight. Optional trackers start off and stay off until a visitor accepts; nothing fires while the banner is being ignored. Reject is one click from the first layer, at the same visual weight as accept. And the analytics or advertising tools are wired through the consent state, which in practice means a tag manager or the platform's built in gating verified by an actual test: decline everything, browse the site, and confirm in the tools' own debug views that nothing recorded you. Small sites often discover their booking or shop plugin runs its own analytics regardless of the banner; the test is what finds it.
The records: a page of writing, kept current
Write down, in a document you control, the trackers and third party services the site uses, what each collects, which consent category it sits in, and when you last checked. Add the banner text and category descriptions as live, with a note of the date any of them changed. Keep the consent choices themselves in the tool's log or an export of it, with timestamps. This modest file is what a complaint actually asks for. It demonstrates that choices on this site were considered rather than accidental, and it doubles as the handover document when whoever built the site moves on, which is when most small site setups silently rot.
The change your mind path
The most common small site failure is not the banner; it is the missing second act. A visitor who accepted last month needs a way back: a Cookie settings link in the footer that reopens the preferences panel, and a privacy page that explains in plain sentences what the site collects and how to withdraw. Test the withdrawal the way you tested the decline. Change the setting, reload, and confirm the trackers stopped and the choice persisted. Regulators and complainants both treat a working withdrawal path as evidence of good faith that outweighs many imperfections elsewhere.
What to skip until you need it
Skip the enterprise apparatus: the multi jurisdiction rule engines if you serve one country, the consent rate optimization dashboards, the quarterly external audits. Spend the money first on the basics being right and on someone checking them twice a year. Revisit when something changes materially: selling into new countries, adding advertising or a shop, or receiving your first complaint. Consent compliance for a small site is a maintained habit, not a purchased product, and the maintenance is an hour a quarter once the foundation exists.
Related reading
These earlier guides cover connected questions in more depth: The Requests Your Page Makes Before Anyone Touches the Banner, Social Media Embeds and Consent: Two-Click Loads, and What the Like Button Already Knows, and Review and Ratings Widgets: The Quiet Trackers Under Every Product Page.
Frequently asked questions
Do I need consent tooling at all if I only run basic analytics?
If the analytics are configured to run without cookies or persistent identifiers and your jurisdiction accepts that basis, possibly not. The moment identifiable tracking, advertising, or embedded third party content enters, you need the banner, the gate, and the record described here.
How long should we keep consent choice records?
While the processing they authorize continues, plus a margin for complaints. For a small site, keeping the log export for a couple of years after a choice is superseded is a workable rule; write down whatever rule you pick in the same document as the tracker list.
Our web designer installed a banner plugin and left. How do we know it works?
Run the two tests in this article yourself: decline everything in a private window and check nothing fires using the analytics tool's real time view; then accept, withdraw through the footer link, and confirm the state changed. Twenty minutes tells you more than the plugin's settings page does.
What should the privacy page actually say?
Plain sentences: what the site collects, through which services, for what purposes, what choices visitors have and where to exercise them, and a contact for questions. Short and true beats long and copied from a template describing tools you do not use.