GDPR Three Years Later: The Compliance Theatre Most Websites Are Still Performing

The compliance that isn’t

In May 2018, GDPR came into force. In the months that followed, millions of European websites added a cookie banner. A significant proportion of those websites then stopped thinking about GDPR.

The cookie banner became the visible symbol of compliance, the thing clients point to when asked “are we GDPR compliant?” The problem is that cookie consent is one component of a regulation that covers data collection, processing, storage, transfer, breach notification, individual rights, vendor contracts, and organisational accountability. Adding a banner addressed approximately 5% of the regulatory scope.

This is not a criticism of businesses that made this mistake. The regulation is complex, the guidance is extensive, and the practical interpretation of requirements took years of regulatory decisions and enforcement actions to clarify. The European Data Protection Board and national supervisory authorities have issued guidance on topics as specific as cookie banner design, the definition of “freely given” consent, and the legality of particular tracking technologies.

What has changed in the years since 2018 is that the enforcement record is now extensive enough to understand what regulators actually look at, and what they find when they look.

What regulators actually find

The GDPR enforcement tracker documents fines across EU member states. The patterns that emerge from the public record are consistent.

Consent mechanisms that are technically present but designed to mislead (where “Accept All” is a large green button and “Reject” requires navigating through three submenus) are a recurring enforcement target. The EDPB’s guidance on “deceptive design patterns” explicitly prohibits interfaces designed to make rejection more difficult than acceptance. Multiple national regulators have fined websites specifically for this pattern, not for missing a banner entirely.

Third-party data transfers without legal basis are a second consistent enforcement area. A website that sends user data to a US-based analytics provider without a valid transfer mechanism (Standard Contractual Clauses or Binding Corporate Rules) is in violation of GDPR Chapter V. The Schrems II ruling in 2020 invalidated the Privacy Shield framework that many companies were relying on. The EU-US Data Privacy Framework that replaced it in 2023 restored some transfer mechanisms, but companies that haven’t updated their documentation since 2020 may be operating on an invalid legal basis.

The UK Information Commissioner’s Office maintains guidance that mirrors GDPR for post-Brexit UK compliance. For businesses serving both EU and UK users, both frameworks apply simultaneously.

The technical gap between a cookie banner and actual compliance

A compliant cookie consent implementation has specific technical requirements that most “cookie banner” plugins do not implement by default.

The default state must be no tracking. This sounds obvious but is violated by a large proportion of implementations: analytics scripts that load on page load before the user has made any consent choice, marketing pixels that activate immediately, and Google Analytics 4 configurations that don’t gate data collection on consent. The OWASP privacy guidelines describe this as a fundamental data minimisation failure.

The consent record must be stored and auditable. When a user accepts or rejects cookies, that decision must be logged with a timestamp, the version of the consent text that was shown, and the specific choices made. When a user later claims they never gave consent, or when a regulator audits the business, this record is the evidence of compliance. Most cookie banner implementations store a boolean in localStorage. That is not a compliance record.

Data Subject Access Requests require a documented process. Under GDPR Articles 15-22, individuals have the right to request a copy of all data held about them, to have it corrected, deleted, or transferred. Businesses are required to respond within one calendar month. The technical implementation this requires (searching all systems that hold user data, extracting relevant records, and delivering them in a readable format) is not automatically provided by any plugin. It requires deliberate design of data architecture to make it possible.

The vendor contract gap

Every third-party service that processes your users’ personal data requires a Data Processing Agreement. This includes the email marketing platform, the analytics tool, the live chat service, the CRM, the form tool, the cloud hosting provider, and the payment processor.

Most major vendors (Google, Mailchimp, HubSpot, Stripe) provide standard DPAs in their terms of service or available for signature in their account settings. The requirement is not that businesses negotiate custom DPAs. It is that they explicitly accept and document the standard ones. Many businesses use these services without having accepted the DPA, which means the legal basis for the data transfer is not established.

The practical impact of this gap becomes visible when something goes wrong. A data breach at a third-party vendor triggers notification requirements that flow upstream to the businesses using that vendor. If the DPA isn’t in place, the business cannot demonstrate it took appropriate steps to establish legal data processing relationships before the breach.

What technical GDPR compliance actually looks like

The W3C’s guidance on privacy by design describes the technical implementation model: data minimisation (collect only what is needed), purpose limitation (don’t use data for purposes other than what was consented to), storage limitation (delete data when it’s no longer needed), and security (technical measures to protect stored data).

Applied to a typical business website, this translates to:

A Consent Management Platform (CMP) that gates all non-essential scripts behind consent, stores consent records with timestamps, and provides a documented API for integrations. Not a cookie banner plugin. An actual CMP, OneTrust, Cookiebot, Usercentrics, or an open-source equivalent.

A Privacy Policy that accurately reflects the data actually collected and processed, not a generic template that lists every possible data type regardless of whether the site actually uses them.

Data Processing Agreements accepted and documented for every vendor handling user data.

A process for responding to Data Subject Access Requests within 30 days, including the technical capability to search all data stores for a specific user’s information.

The [Webxtek Studio maintenance service](/en/services/maintenance/) includes GDPR technical compliance audits for SaaS and technology platforms and B2B service businesses operating in the EU market. The audit consistently reveals the same gaps: cookie consent bypassed by scripts loading before consent, missing DPAs for standard vendor tools, and no documented DSAR process. These are not sophisticated compliance failures. They are the predictable result of treating a cookie banner as the end of the compliance process rather than the beginning.

The regulation is six years old. The enforcement record is substantial. The technical requirements are documented. The remaining gap is between knowing what compliance looks like and implementing it.