Does my small business website need a privacy policy and a cookie banner?

Last updated 30 October 2026. Written by Oyekola Obajuwon, founder of Growveloper, a growth studio that builds the website, the marketing and the follow up for owner run businesses in the United States, the United Kingdom and Nigeria. This is a developer's reading of the rules, not legal advice.

If your website has a contact form, it collects names and email addresses, so it needs a privacy policy in the UK, in Nigeria and for visitors from California. A cookie banner depends on what the site runs. Advertising pixels need a yes first. In Nigeria every cookie beyond the essentials needs an accept or decline.

Most of what you will read on this question is written by companies that sell banners and policies. They are not wrong, but they answer for every country at once and never ask what your site actually does. Two questions decide it: what does the site collect, and what does it run.

Does a small business website need a privacy policy?

Yes, if it collects anything that points to a person, and a contact form does. A name, an email address and a phone number are personal data the moment someone presses send.

In the UK, the Information Commissioner's Office puts it plainly in its guidance on the right to be informed: "You must provide privacy information to individuals at the time you collect their personal data from them." In the US there is no single national rule, but California's law reaches any business whose site is visited by Californians. Section 22575 of its Business and Professions Code says "An operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site". A plumber in Ohio does not choose who visits.

A brochure site with no form, no analytics and no embedded videos collects close to nothing. Almost no small business site is that site.

Do I need a cookie banner on my website?

It depends on what the site runs, not on its size. The essentials, like the cookie that keeps a basket full or remembers a login, never need one. What needs a yes is anything that follows the visitor for someone else's purpose: the Meta pixel, the Google Ads tag, the TikTok pixel. Analytics sits in the middle, and that is where the countries split.

Open your site, look at what loads, and list it. If the list is only your own pages, you may need no banner at all in the UK. If it holds one advertising pixel, you need a yes before it fires.

What changed for cookies in the UK?

Simple visitor counting no longer always needs a yes. The ICO's page on the exceptions now lists five cases where a site can store or read information without consent, and one is for statistics about how the site is used, with a view to improving it. Its own line on the limit: "It is about how your service is used, not about who uses it."

There are two conditions. You must tell visitors clearly what you count and give them a simple, free way to object. And it does not stretch to ads: "It also doesn't apply to things like online advertising." An analytics setup that also feeds an ad platform is on the consent side again.

What are the rules for websites in Nigeria?

Stricter on the banner than the UK. The Nigeria Data Protection Commission's General Application and Implementation Directive took effect on 19 September 2025, according to DLA Piper, which had it confirmed by the Commission. I could not open the Commission's own copy, so this is a law firm's reading of it. Templars' client alert on the directive says "Data controllers and processors are required to provide privacy and cookie notices on the homepage of their websites."

The banner must offer accept or decline for every cookie beyond the necessary ones, and it must be seen. The same alert: "Under the GAID, the display of a cookie notice at the bottom of a webpage is regarded as a lack of transparency in data processing". The thin strip along the bottom of the screen that most templates ship is, in Lagos, the wrong banner.

What are the rules in the US?

There is no federal cookie banner law. What there is: California's posting rule above, and the Federal Trade Commission. The FTC's privacy and security guidance for business says that when a company makes privacy promises, the FTC Act requires it to keep them. So the risk for a US small business is less the missing banner than the policy that says one thing while the site does another.

California's law gives a business 30 days to post a policy after being told it is missing. That is a grace period, not a plan.

What should a small business privacy policy say?

What you collect, why, how long you keep it, and who else sees it. The ICO's list is purposes, retention periods and who the data will be shared with. California adds the categories of information you collect and the kinds of companies you share it with.

Write it for your site, not from someone else's. A template copied from a shop that sells abroad will promise things you never do, and the FTC's point is that a promise you break is the problem. Name the tools by name: the form provider, the email platform, the analytics, the booking system. Our own is at growveloper.com/privacy if you want to see a short one. Who holds the logins to each of those tools matters too; I covered that in do I own my website if a developer built it.

Can a cookie banner look right and still be wrong?

Yes, and mine did. In September 2026 I found my own site's Google Analytics showing zero users while Microsoft Clarity showed people visiting. The banner looked finished. It had an Accept all button, the button closed the banner, and nothing on screen was wrong.

Behind it, the message telling Google's tag that the visitor had said yes was sent in a format the tag ignores. So every visitor who pressed Accept all was recorded as a no. The law was being kept, in the most expensive way: I was refusing my own data. I fixed it and confirmed it on 24 September, when the next visit arrived in Analytics as a yes.

A banner can fail the other way too, firing the pixel before anyone answers, and that one breaks the law instead of your numbers. The test takes two minutes. Open your site in a private window, press the reject or necessary only button, and check that the advertising pixels did not load. Then do it again with accept, and watch your visit arrive in the analytics Realtime report. I walk through that report in how to track enquiries from your website in Google Analytics.

What would I set up on a small business site?

A short privacy policy, written for the site and linked in the footer and beside the contact form. A banner only if the site runs something beyond the essentials, with the no button the same size as the yes; ours offers Accept all and Necessary only side by side. In Nigeria, the banner sits where a visitor cannot miss it. Then the two minute test, run again every time a tool is added.

When I set up Google Analytics, Tag Manager and Clarity from zero for Baye Business Solutions, the tags and the consent were one job, because each one decides what the other is allowed to record. If you are hiring someone to build or rebuild your site, put the banner and the policy in the brief you write for the developer, so it is priced in and not bolted on.

If you want it set up and tested once, that is part of the web development I do. The offer is a free 30-minute call, no pitch, and 20% off if we build, booked at cal.com/growveloper/30. For health or financial data, or for selling into the EU at scale, talk to a lawyer as well.

The form needs the policy. The pixel needs the yes. And the banner needs one test before you trust it.