A business website must clearly explain what data it collects and why, through the privacy notice required by the GDPR, and ask for consent before using any cookies other than technical ones. Under the cookie guidelines issued on 10 June 2021 by the Garante, Italy’s data protection authority, visitors must be able to close the banner with an X without accepting, scrolling doesn’t count as consent and choices must be changeable at any time.
The rules that apply.
Personal data is governed by EU Regulation 2016/679, the GDPR. For cookies, the practical reference in Italy is the Guidelines on cookies and other tracking tools issued on 10 June 2021 by the Garante per la protezione dei dati personali, the Italian data protection authority. In both cases the data controller is you: you decide what data to collect and why.
Besides privacy and cookies, your website must also show your VAT number, company details and contacts: the full list is in our guide “What a business website must include by law”.
The privacy notice.
When you collect data from someone, you must tell them at that moment, in clear and plain language:
- who you are and how to contact you;
- why you’re collecting the data and on what legal basis;
- who it may be shared with;
- how long you’ll keep it;
- what rights they have: access, rectification, erasure, objection and the others set out in the GDPR;
- that they can complain to a supervisory authority, which in Italy is the Garante.
The notice must be easy to find: usually there’s a link in the footer of every page of the website.
Contact forms: little data, lots of clarity.
- Ask only for the data you need to reply: the GDPR requires data to be limited to what’s necessary.
- Put the link to the privacy notice next to the send button.
- For any extra use, such as a newsletter or offers, ask for separate consent, with a box the person ticks themselves: pre-ticked boxes don’t count as consent.
- Withdrawing consent must be as easy as giving it.
Technical cookies and cookies that need consent.
Technical cookies make the website work: for these, the privacy notice is enough. If a website only uses technical cookies, according to the Garante no banner is needed. Profiling cookies and other tracking tools, such as those used for advertising, can only be activated after consent: on the first visit nothing beyond technical cookies should run. Cookies for visitor statistics are treated like technical ones only under certain conditions, for example if they reduce the ability to identify visitors and produce only aggregate statistics.
Watch out for third-party services embedded in your pages, such as maps, videos, social media buttons or analytics tools: they may use third-party cookies and should be checked one by one.
What the banner must look like.
The model set out by the Garante includes:
- an X in the top right corner that closes the banner without accepting, as prominent as the other buttons, with a sentence explaining it;
- a button to accept all cookies;
- a link to choose cookie categories one by one, all switched off at the start;
- a link to the full privacy notice.
Buttons and text must have the same size, emphasis and colours: if you add a “Reject” button, it must be as visible as “Accept”. Scrolling the page doesn’t count as consent, and a cookie wall, where the site only opens if you accept, isn’t allowed except in particular cases to be assessed individually. If someone declines, the banner shouldn’t be shown again for at least six months, unless something important changes. And the footer needs a link, such as “Review your cookie choices”, so people can change their mind at any time.
If your website uses a chatbot or AI-generated images, the transparency rules explained in our guide The AI Act and your business also apply.
How we handle it at Aleryc.
On Aleryc’s websites, a privacy notice is always provided when the website collects data, while a cookie policy and consent banner are provided when the website uses non-technical cookies: we rely on a specialised service that keeps them up to date with regulations and that we activate in our own account, like the domain: they’re a separate item, priced in tiers by type, shown in the quote. The contact form shows the privacy notice and, if extra uses such as a newsletter are needed, a separate consent checkbox. Legal responsibility for the data collected remains yours, as the business owner. Questions? Write to us (in English, by email or WhatsApp).
Sources.
- EUR-Lex: Regulation (EU) 2016/679 on the protection of personal data (GDPR)
- Garante per la protezione dei dati personali: Guidelines on cookies and other tracking tools, 10 June 2021 (in Italian)
- Garante per la protezione dei dati personali: executive summary of the cookie guidelines (in English)
Sources consulted on 27 October 2026. This guide is for information only and is not a substitute for legal advice: for the wording of your privacy notice and banner, speak to a professional or a specialised service.