Cookie Consent for Nonprofit and Charity Websites: Same Rules, Tighter Budgets
Charity websites run a familiar stack: a donation platform, an analytics account nobody has opened since it was installed, a video embed, a social feed, and a cookie banner the site template brought with it. Everyone involved means well, and the consent setup is often worse than a commercial site's, because no one person has ever owned it.
Regulators do not grade on intention or budget, but the compliance gap for a typical charity site is closable in a weekend with free and cheap tools. This guide gives the proportionate version: what to fix first, what can wait, and how to keep it fixed when the volunteer who built the site moves on.
Start with an honest inventory
List every third party loading on the site, using the fresh browser test: donations, analytics, video, maps, social embeds, live chat, and the fundraising widgets that campaign pages accumulate. Small charities routinely discover tools added for a single appeal years ago, still collecting on every page.
Cut before you configure. Every tool nobody can justify is a tool that needs no consent management, no privacy notice paragraph, and no vendor review. A small site that runs three third parties well is compliant in a way a site running eleven badly never will be.
The donation flow deserves special care
Donation pages carry the site's most sensitive relationship. Check what loads there beyond the payment processor itself: advertising pixels on donation pages are common, inherited from site wide tag setups, and they mean a supporter's generosity is being reported to ad platforms as a conversion event.
Wall off the donation journey: only the tools the donation itself needs, with any measurement done in aggregate and described in the privacy notice. Donors who learn their giving was tracked for advertising rarely give again, and they tell the story with the charity's name attached.
A banner a small team can maintain
Choose a consent tool at the free or low cost tier whose configuration you understand, set it to block optional tools until consent, and write the choices in plain words a supporter would use. The banner's wording is not the place for legal defensiveness; supporters respond to the same honesty they expect from the charity's fundraising.
Document the setup in one shared page: what the tools are, who owns the accounts, when consent behaviour was last tested. Charity teams change; the document is what stops the setup decaying back into archaeology at every handover.
Tell supporters, briefly and proudly
A short privacy page written for humans, what we collect, why, and the choices you have, does more for a charity than a long policy, because supporters actually read it. Charities trade on trust; being visibly careful with data is fundraising infrastructure, not overhead.
Review the whole setup annually, ideally alongside the accounts review, when other governance questions are already on the table. An hour a year keeps a small site honest, which is all the rules, fairly read, were ever asking for.
Related reading
These earlier guides cover connected questions in more depth: Cookie Consent for Nonprofit and Charity Websites: Same Rules, Tighter Budgets, Consent in Fitness Apps: Workout Data, Location Trails, and Sharing Defaults, and Cookie Walls and Pay or Consent: When Charging for Privacy Is Allowed.
Frequently asked questions
Are charities exempt from cookie rules as nonprofits?
No. Consent rules apply to any organisation running a website with optional trackers, regardless of profit status. Some regulators publish charity specific guidance, but the core duties are the same.
We only use analytics. Do we still need a banner?
If the analytics set cookies or identifiers before consent, yes, in consent based regions. Alternatively, switch to a privacy respecting analytics setup that avoids identifiers entirely, which removes the need for that part of the banner.
Our donation platform is external. Is its consent their problem?
The platform handles its own pages, but the tools on your pages that lead there, and any pixels you placed, remain yours. Check the handoff too: what supporter data your site passes to the platform in the link itself.
What should we fix first with no budget at all?
The inventory and the cuts: removing unjustified tools costs nothing and shrinks the problem immediately. Then a free tier consent tool and a plain language privacy page cover most of what remains.