Website Forms and Lead Forms
PracticeEvery form on your site — contact forms, newsletter signups, gated content downloads, demo requests — collects personal data and needs the same notice-and-consent discipline covered in Chapter 04.1. A lead-generation form that bundles "submit this form" with an implied consent to unrelated marketing communications is one of the more common website-specific violations of the "specific" consent standard.
Consent Checkboxes
Where a form includes an optional purpose beyond fulfilling the request itself (adding the submitter to a newsletter, sharing their details with a partner), that needs its own separate, unticked checkbox — not a single "I agree to the Terms and Privacy Policy" checkbox covering everything the form might ever be used for.
Privacy Notices
LawA general, site-wide privacy policy is still worth having, but it doesn't substitute for the point-of-collection notice Section 5 requires alongside a specific consent request. The two serve different purposes: the privacy policy is the comprehensive reference; the point-of-collection notice is the specific, plain-language explanation shown right where a particular piece of data is actually being collected.
Cookies
LawCookies and similar tracking technologies that identify a visitor, or contribute to identifying one when combined with other data, are collecting personal data and need consent on the same basis as any other collection — with essential/strictly-necessary cookies (session management, security, basic functionality) generally not requiring separate consent, since they're needed to deliver the service the visitor is actually requesting.
Analytics
PracticeStandard web analytics tools collect IP addresses, device identifiers, and browsing behaviour — data that's personal in the sense covered in Chapter 02 whenever it's tied, directly or through combination, to an identifiable visitor. Analytics consent should be its own distinct purpose, separate from marketing or functional cookie consent, since a visitor may reasonably want to allow one without the other.
| Tool | What it typically collects | Consent implication |
|---|---|---|
| Google Analytics (GA4) | Device ID, IP, browsing behaviour, approximate location | Needs analytics-purpose consent before firing |
| Google Tag Manager | A container for other tags — its own impact depends on what it's configured to fire | Consent gating should apply to the tags it loads, not bypass them |
| Meta Pixel / ad pixels | Device ID, browsing behaviour, conversion events tied to an ad account | Needs marketing/advertising-purpose consent before firing |
Third-Party Scripts
PracticeChat widgets, embedded videos, social share buttons, and A/B testing tools are all third-party scripts that can collect personal data on your site's behalf — each one is worth an explicit inventory entry (Chapter 07) noting what it collects and whether it's gated behind consent, rather than assuming a script is harmless simply because it's small or came bundled with a page builder or theme.
Consent Banners
The practical mechanism for capturing website consent — covered in depth in Chapter 04.1. The key website-specific point: the banner needs to actually block non-essential scripts from firing until a choice is made, not merely display alongside scripts that are already running in the background.
Installing a consent-banner plugin that displays correctly but isn't actually wired to block the analytics and advertising tags underneath it — so scripts fire immediately on page load regardless of what a visitor selects. A banner that's purely cosmetic is arguably worse than no banner at all, since it visibly claims a consent standard the site isn't actually meeting.
Consent Logs
PracticeYour website's consent records (Chapter 04, "Consent Records") should be genuinely queryable — able to answer "what did this specific visitor or user agree to, and when" — not just a real-time cookie flag with no history once it's overwritten by the next visit.
User Rights on the Website
The rights covered in Chapter 05 need a reachable path on your website too — a visible, working link to a preference centre or a contact method for rights requests, not only a mention buried in a privacy policy's final paragraph.