Compliance Basics for Going Global: Privacy, Cookies, GDPR
Privacy policies, cookie consent, and GDPR/CCPA are the most commonly skipped pre-launch items. Below is a same-day minimum-viable compliance checklist.
Minimum-viable compliance checklist
(1) Privacy Policy: what data you collect, why, who you share with, how to delete. (2) Terms of Service: rights, obligations, refunds. (3) Cookie consent: required for EU users if you use third-party scripts like GA4 or Hotjar. (4) DPA (Data Processing Agreement): B2B SaaS customers will request one — start with a Termly template.
Common GDPR misconceptions
Myth 1: 'I'm not in the EU, GDPR doesn't apply' — wrong: if your site is reachable from the EU and collects EU user data, you are in scope. Myth 2: 'Cookies are illegal' — GDPR doesn't ban cookies; it bans unconsented non-essential cookies. Myth 3: 'I added a cookie banner, I'm compliant' — the banner is cosmetic; the real test is whether your backend honors 'reject' and stops firing tracking scripts.
Engineering recommendations
Use Termly or iubenda templates to bootstrap policy text and the cookie banner. Configure GA4 with IP anonymization and skip tracking when consent is denied. Provide data export and deletion endpoints for EU users. App Store / Play Store now require Privacy Manifests at submission — failing to provide one blocks review.
When to involve a lawyer
(1) Health, medical, or kids data (COPPA); (2) B2B customers requiring custom DPAs; (3) regulated industries (finance, crypto, gambling); (4) due diligence during fundraising. For other early-stage cases a template + one lawyer review is enough.