What Is GDPR and Why Does It Affect Your Site?
The General Proteção de Dados Regulation (GDPR) is the world's strictest privacidade law. It came into force in 2018 and in 2026 remains the global reference standard for personal proteção de dados. If your site is accessible from the European Union or collects data from European citizens, you must comply with GDPR, regardless of where your company is based.
Fines for non-conformidade are severe: up to 20 million euros or 4% of annual global turnover, whichever is greater. In 2025, European authorities imposed fines totaling over 2 billion euros, and the trend continues upward.
Who does it affect?
- Any company selling products or services to people in the EU
- Any site receiving European visitors
- Mobile aplicaçãos available in the EU
- E-commerce shipping to Europe
- Latin American empresas with European clients
- Startups operating globally
The 7 Fundamental Principles of GDPR
- Lawfulness, fairness, and transparência: you must have a legal basis for processing data and be transparent about how you use it
- Purpose limitation: data is only used for the stated purpose
- Data minimization: collect only the data strictly necessary
- Accuracy: keep data atualizado and correct
- Storage limitation: don't keep data longer than necessary
- Integrity and confidentiality: protect data with adequate segurança measures
- Accountability: demonstrate that you comply with all the above principles
Technical Implementação: What Your Site Needs
1. Cookie banner with granular consent
A simple cookie notice isn't enough. GDPR requires the user to be able to accept or reject each category of cookies individually:
- Essential cookies: always active (session, segurança, cart) — no consent required
- Analytics cookies: Google Analytics, Hotjar — require explicit consent
- Marketing cookies: Facebook Pixel, Google Ads — require explicit consent
- Personalization cookies: language, theme preferences — require consent
The banner must load before any de terceiros script. If the user doesn't accept, those scripts must not execute.
2. Forms with explicit consent
Each form collecting personal data must include:
- Consent checkbox not pre-checked
- Link to privacidade policy
- Clear description of what the data will be used for
- Option to withdraw consent at any time
3. Complete privacidade policy
Your privacidade policy must include:
- Identity and contact details of the data controller
- Proteção de Dados Officer (DPO) details if applicable
- Purpose of processing and legal basis
- Categories of data collected
- Recipients of data (third parties)
- International data transfers
- Retention periods
- User rights (access, rectification, erasure, portability)
4. User rights implemented
Your site must make it easy for users to exercise their GDPR rights:
| Right | What it means | Technical implementação |
|---|---|---|
| Access | User can request a copy of their data | Data export endpoint in JSON/CSV format |
| Rectification | Correct inaccurate data | User panel with profile editing |
| Erasure (right to be forgotten) | Delete all their data | Account deletion button + cascading delete |
| Portability | Receive data in standard format | JSON/CSV download with readable structure |
| Objection | Object to processing | Privacidade preferences center |
GDPR-Compatible Alternatives to Google Analytics
Google Analytics has been the subject of multiple rulings in Europe declaring it incompatible with GDPR due to data transfers to the United States. European alternatives recomendamos:
- Plausible Analytics: lightweight (1KB), no cookies, EU servers, open source. No cookie banner needed.
- Matomo: the most complete alternative. Can be self-hosted on European servers. Properly configured, it doesn't require cookie consent.
- Fathom Analytics: simple and private, with EU servers and GDPR-compatible data processing.
- Umami: open source, self-hosted, no cookies, no personal data.
Na AvilaDev, we configure Plausible or Matomo as standard on all our projects targeting the European market.
Real Fines: What Non-Conformidade Custos
Real cases of GDPR non-conformidade sanctions:
- Meta (Facebook): 1.2 billion euros for illegal data transfer to the US
- Amazon: 746 million euros for targeted advertising practices
- Google: 90 million euros for cookies without proper consent
- H&M: 35 million euros for employee surveillance
- SMEs: fines of 5,000 to 50,000 euros for forms without consent, cookies without banner, or missing privacidade policy
Data protection authorities no longer only pursue large empresas. In 2025, SMEs accounted for 40% of GDPR sanctions.
Privacidade by Design
GDPR doesn't just require conformidade — it requires your site to be designed with privacidade in mind from the very start. This means:
- Minimization by default: forms ask only for what's essential (name and email, not full address if unnecessary)
- Encryption by default: HTTPS across the entire site, sensitive data encrypted in the database
- No tracking by default: analytics and marketing cookies only activate after explicit consent
- Anonymization: analytics data automatically anonymized (truncated IP, no user ID)
- Limited retention: data automatically deleted when no longer needed
GDPR Conformidade Checklist for Your Site
- Cookie banner with granular consent (not pre-checked)
- De terceiros scripts blocked until consent is obtained
- Complete and atualizado privacidade policy
- Forms with explicit consent checkbox
- HTTPS across the entire site
- Encrypted data in the database
- Mechanism for exercising rights (access, erasure, portability)
- Consent records (who consented, when, for what)
- Data processing agreements with de terceiros providers
- Proteção de Dados Impact Assessment (DPIA) if applicable
- DPO designated if processing data at scale
- Segurança breach notification procedure (72 horas)
How AvilaDev Builds GDPR-Compliant Sites
Na AvilaDev, privacidade is an integral part of our desenvolvimento process, not a last-minute add-on:
- Privacidade audit before starting desenvolvimento
- Consent Gestão Plataforma integrated in every European project
- Private analytics (Plausible/Matomo) as standard
- Data encryption in transit and at rest
- Conformidade documentação: privacidade policy, processing records
- Privacidade testing: we verify that scripts don't load without consent
Need a site that complies with GDPR from day one? Request a consultoria gratuita with our equipe specialized in desenvolvimento web for the European market.
