Privacy compliance can feel disproportionately complicated when you are building a relatively simple hobby website.
You may only want to publish helpful articles, allow occasional comments and see whether anyone visits. Yet you soon encounter privacy policies, cookie policies, consent categories, regional legislation and plugins offering different levels of protection.
It is tempting to install a cookie banner, publish a standard privacy-policy template and assume the problem has been solved. I used to think that a common-sense approach would probably be sufficient: keep people’s information secure, use it only for the purpose they expected and provide an easy way to opt out.
Common sense remains a good starting point, but it does not guarantee compliance. More importantly, you cannot produce an accurate privacy policy unless you understand what your website actually does.
Researching this subject encouraged me to examine my own setup. I eventually changed my cookie-consent plugin, learned more about the services operating on my website and developed a much clearer idea of what a hobby website owner needs to do.
This article is not legal advice. It is a practical starting point for owners of relatively straightforward WordPress websites.
Start with what your website actually does
Before choosing a plugin or generating a policy, list all the ways someone can interact with your website.
For each interaction, ask:
- What information is collected?
- Why is it needed?
- Where is it stored?
- Is it shared with another company?
- How long is it retained?
- Can the visitor refuse or withdraw permission?
On Action With AI, the main services and interactions include:
- Google Site Kit and Analytics
- Embedded YouTube videos
- WordPress comments
- A contact form
- Affiliate links to Wealthy Affiliate
That is not an especially complicated setup. Nevertheless, each item works differently.
Google Analytics may measure how visitors use the site. An embedded YouTube video may connect to an external service. Comments and contact forms collect information that visitors submit deliberately. An affiliate link may take someone to another website where referral tracking takes place.
A cookie banner alone does not explain or control every one of those activities.
Cookies and submitted information are not the same thing
It helps to separate website privacy into three broad areas.
Necessary website functions
Some technologies are required to provide a function requested by the visitor or to operate the website securely.
Examples might include maintaining a logged-in session, remembering products in a shopping basket or distributing website traffic between servers.
These are different from cookies used primarily for analytics, advertising or behavioural tracking. Not every cookie automatically requires consent, although visitors should still receive appropriate information about their use.
Optional tracking and embedded services
Analytics, advertising trackers and externally embedded content may involve cookies or similar technologies that are not essential for someone to read the website.
Under the UK approach, these technologies generally should not be activated before the visitor has made an informed choice.
This is why a proper consent system needs to do more than display a message saying, “This website uses cookies.” It must control the relevant technologies and respect the visitor’s decision.
Information visitors provide deliberately
When someone leaves a comment or sends a contact-form message, they knowingly provide information such as a name, email address and message.
This is not handled merely by asking whether they accept cookies. The privacy information should explain why those details are collected, how they are used, where they go and how long they may be retained.
The distinction matters because website owners often treat privacy compliance as a cookie-banner exercise. Cookies are only one part of the picture.
What should a privacy policy explain?
A privacy policy should reflect the website that actually exists.
Depending on the circumstances, it may need to explain:
- who operates the website;
- how the operator can be contacted;
- what personal information is collected;
- why that information is needed;
- the legal basis for using it;
- where it is stored;
- which external services may receive it;
- how long it is retained;
- what rights visitors have;
- how visitors can exercise those rights.
WordPress includes a Privacy Settings tool under Settings → Privacy. It can create a starter page and collect suggested wording from WordPress, the active theme and participating plugins.
That is useful, but WordPress itself warns that the resulting text is not a complete compliance process. External services, analytics providers, affiliate partners and embedded media may not all be detected. Every website owner still needs to check that the finished policy describes what happens on their particular site.
This is why copying an impressive-looking policy from another website is a poor solution. That website may collect completely different information and use services you do not have.
A generated template is a starting point, not evidence that you have understood your website.
What should a cookie banner do?
The UK Information Commissioner’s Office explains that consent must be freely given, specific and informed. It requires an unambiguous positive action.
In practical terms, a suitable consent setup should:
- explain the main cookie categories in understandable language;
- provide a genuine choice;
- make rejection reasonably as easy as acceptance;
- avoid activating non-essential cookies before consent;
- honour a visitor’s rejection;
- provide a way to change or withdraw the choice later.
A banner can look completely professional while failing to do some of these things.
For example, a website might display an Accept button while hiding rejection behind several screens. Worse, Analytics or advertising scripts might already be operating before the visitor clicks anything.
The appearance of a banner is therefore less important than its behaviour.
Why I changed from CookieYes to Complianz
I previously used the free version of CookieYes and configured it to display a worldwide consent banner. I was not particularly unhappy with it, but researching this article gave me a reason to examine the alternatives and consider whether I could create a better setup.
I looked at several WordPress consent plugins. With some of them, I experienced difficulties scanning the website or even completing parts of the initial setup.
I eventually tried Complianz and found that it simply worked better for me.
Its wizard led me through each stage in a way that was easy to follow. That was particularly helpful because cookie consent is much more extensive and detailed than it first appears.
The website scan worked seamlessly. It identified several relevant parts of Action With AI, including:
- Google Site Kit
- YouTube embeds
- comments;
- the contact form.
The overall presentation also felt more joined-up. Instead of merely installing a banner, I felt that I was being guided through an examination of what the website was actually doing.
That does not mean Complianz guarantees legal compliance or is automatically the best choice for every website. The site owner must still answer its questions accurately, review the generated documents and test the resulting configuration.
However, for my relatively straightforward hobby website, I found it easier to understand and use than the alternatives I tried. I would recommend considering it if you need a manageable way to start addressing cookie consent on a WordPress site.
Why I selected the UK configuration
I am based in the UK, so I chose the UK as the principal legal region in the Complianz wizard.
There is a slight complication: Search Console currently shows that a large proportion of Action With AI’s search impressions come from the United States.
However, an impression only means that a page appeared in a search result. It does not necessarily mean the person visited my site or provided any information.
Complianz Free allows one selected legal configuration to be applied to visitors worldwide. Serving different configurations automatically according to each visitor’s location is a more advanced premium feature.
For my present site, applying the UK configuration worldwide seems like a sensible and manageable approach. It gives visitors clear choices over optional technologies, regardless of where they live.
This does not mean UK compliance automatically covers every law in the United States. US privacy law is fragmented, and different states can provide rights that are not identical to the UK consent model. California, for example, has particular rules for covered businesses concerning the sale or sharing of personal information and Global Privacy Control signals.
Nevertheless, switching my entire configuration to the US simply because many search impressions originate there would not necessarily improve matters. I operate the website from the UK, and the UK approach provides a relatively privacy-protective default for an international audience.
I would revisit that decision if the website developed substantial traffic, revenue or data-processing activities.
How I tested whether the banner was working
After configuring Complianz, I tested the website as a new visitor.
The banner allowed me to accept or reject optional technologies and provided links to both the privacy policy and cookie policy. From my testing, Google Analytics and embedded YouTube content appeared to remain blocked after I rejected the relevant options.
That gave me greater confidence that the plugin was controlling those services rather than merely displaying a notice.
This was a practical check, not a complete professional privacy audit. Nevertheless, it is a useful exercise that any beginner can perform.
A simple test might involve the following:
- Open the website in a private or incognito browser window.
- Do not make a consent choice immediately.
- Check whether optional embedded content or tracking appears to activate.
- Reject optional cookies.
- Confirm that optional services remain blocked.
- Open another private window and accept the relevant category.
- Check whether the service then becomes available.
- Reopen the consent settings and confirm that the decision can be changed.
You can also use your browser’s developer tools to inspect cookies, although beginners may find that interface confusing. The most important first step is to check the visitor’s actual experience before and after each choice.
Repeat the test after adding a significant new plugin, tracking service or embedded feature.
Comments and contact forms need privacy information too
Complianz identified comments and my contact form during its scan. These are important even though they are not simply optional tracking services.
A contact form may collect a name, email address and the contents of a message. Depending on the plugin and configuration, that information might be emailed to the site owner, stored inside WordPress or passed through an anti-spam service.
WordPress comments may also collect a name, email address, IP address and browser information. A visitor may be offered a cookie that remembers their details for a future comment.
Your privacy policy should describe what happens in your particular setup.
It is not enough to say, “We value your privacy.” A useful policy explains what information is involved and what you actually do with it.
Privacy information should also be accessible at the point where information is collected. For example, a contact form can include a brief statement and a link to the complete privacy policy.
Affiliate disclosure is a separate responsibility
Wealthy Affiliate is currently the only product I recommend through an affiliate relationship on Action With AI.
I have a dedicated affiliate-disclosure page that specifically identifies that relationship. I have also been a Wealthy Affiliate member since 2015, so my recommendation is based on long-term personal experience.
Nevertheless, readers should be told clearly when I may receive a commission.
Affiliate disclosure is related to transparency, but it is not the same thing as a privacy or cookie policy. A website may therefore need all three:
- a privacy policy;
- a cookie policy;
- an affiliate disclosure.
A disclosure page is useful, but readers should not have to search for it before discovering that a particular recommendation has a commercial connection. Relevant affiliate content should also include clear wording close to the recommendation.
For example:
I have been a Wealthy Affiliate member since 2015. Some links to Wealthy Affiliate are affiliate links, which means I may receive a commission if you join through them. This does not affect the price you pay. My recommendation is based on my own experience, and the rest of this website remains useful whether or not you choose Wealthy Affiliate.
An ordinary affiliate link may take the visitor to another company’s website, where that company operates its own tracking and privacy practices. That is different from installing an advertising pixel that tracks activity directly on your site, but the commercial relationship still needs to be disclosed.
A proportionate approach does not mean ignoring privacy
Action With AI is currently a developing website with modest traffic. I have Analytics installed through Site Kit, but I do not examine its reports particularly often at present. That will probably change if visitor numbers grow.
The fact that I rarely look at Analytics does not prevent it from processing information. The relevant question is what the technology does, not how frequently I inspect the results.
At the same time, the privacy arrangements needed by a small hobby website are unlikely to be as extensive as those required by a major publisher, membership platform or ecommerce business.
A proportionate approach means establishing a sensible system now and reviewing it when the website changes.
Important review points include introducing:
- an email newsletter;
- advertising;
- additional affiliate networks;
- Meta or Pinterest tracking pixels;
- memberships or user accounts;
- an online shop;
- surveys or competitions;
- services aimed at children;
- collection of sensitive information.
A major increase in traffic, revenue or international reach would also justify a more thorough review. At that point, premium regional controls or professional advice may become appropriate.
Low traffic does not remove privacy responsibilities, but neither should the complexity of privacy law prevent someone from starting a simple hobby website.
A beginner’s privacy and cookie checklist
For a relatively straightforward WordPress website, use this process:
- List every way visitors can interact with the site.
- Identify the plugins and external services involved.
- Run a cookie and service scan.
- Read the results rather than accepting every default blindly.
- Separate necessary functions from optional tracking.
- Create privacy and cookie policies that describe the real website.
- Provide clear acceptance and rejection choices.
- Check that optional services respond correctly to those choices.
- Give visitors a way to change their preferences.
- Disclose affiliate relationships clearly.
- Test everything in a private browser window.
- Review the setup whenever the site changes materially.
Keep a note of when you conducted the review and what you found. That makes future checks easier and creates evidence that you have taken the issue seriously.
You do not need to become a privacy expert
Privacy law is detailed, and no WordPress plugin can remove the website owner’s responsibility entirely.
However, a beginner does not need to become a privacy lawyer before publishing a hobby website. The essential starting point is to understand the journey that visitor information takes through the site.
In my case, changing to Complianz made that process easier. Its wizard and website scan helped me identify the services I was using, configure a clearer consent system and test what happened when optional cookies were rejected.
My conclusion is not simply “install Complianz and you are compliant.”
It is this:
Use a guided tool to understand what your website is doing, configure it honestly, test the result and revisit it whenever the website’s activities materially change.
That is a much stronger foundation than publishing a generic policy and hoping it covers everything.