Privacy and compliance
GDPR
The General Data Protection Regulation governs personal data processing for people in the European Union and the European Economic Area, requiring a lawful basis, transparency, data minimisation and defined rights.
What is gdpr?
The General Data Protection Regulation governs personal data processing for people in the European Union and the European Economic Area, requiring a lawful basis, transparency, data minimisation and defined rights.
Why it matters
It applies by the location of the person rather than of the business, so a site with European visitors is in scope wherever it is hosted.
How it gets implemented
Addressed with a documented lawful basis per purpose, consent that is freely given and withdrawable where consent is the basis, and a processing record.
What people get wrong
Consent is one of six lawful bases, not the only one. Asking for consent where a different basis applies creates an obligation that did not need to exist.
It is a small idea with a disproportionate effect on how a site performs.
Where this comes up in the work
It is part of Answer Engine Optimization, and more specifically of Voice and assistant answers. Across the rest of the work it shows up in:
- Lifecycle and Email, where it is the difference between finding where the email promises something the landing page does not deliver working and appearing to
- Analytics and Measurement, in which it shows up as separating what is measured from what is modelled, in the report itself
- Brand and Creative, which cannot be done properly without it
- Generative Engine Optimization, since separating what the brand can influence from what it cannot is only as good as this is
What to check
Two questions that establish whether this is actually in order on a given site:
- Whether the measurement that would expose a problem is even being collected
- Whether a change to it would be noticed, or discovered a quarter later
More in privacy and compliance
Common questions
How urgent is gdpr?
It comes before work that assumes it is already handled, and after anything actively blocking indexation.
How would we know gdpr is a problem?
The symptom is usually downstream: it applies by the location of the person rather than of the business, so a site with European visitors is in scope wherever it is hosted, showing up as something else entirely in the reporting.
Is gdpr just another name for something?
Consent is one of six lawful bases, not the only one. Asking for consent where a different basis applies creates an obligation that did not need to exist. The distinction matters because the two are fixed differently.
Is gdpr a ranking factor?
It applies by the location of the person rather than of the business, so a site with European visitors is in scope wherever it is hosted. Whether that becomes a ranking change depends on what else is true about the site, which is why it is worth measuring rather than assuming. The short version is here. Finance and fintech and Healthcare and clinics are the long ones.
How do you check gdpr on a site?
Addressed with a documented lawful basis per purpose, consent that is freely given and withdrawable where consent is the basis, and a processing record. The check is cheap; the fix is where the work sits. Pair this with Paid Social and Meta Ads, and with Technical SEO if the market is competitive.
Whose job is gdpr?
It needs one named owner rather than a shared responsibility. The natural home is Google Ads Management, since writing ad copy that survives being assembled in an order nobody chose is where the consequence lands. The adjacent reading is Lead form or Landing page, and Local SEO or National SEO for the version of this question that comes up later.
Have the awkward questions answered first
Thirty minutes, the data you already hold, and a straight answer about where the constraint actually is.