If your site serves visitors in the EU, including dealer sites syncing inventory from mobile.de, GDPR compliance isn’t optional, and enforcement has only gotten stricter. Here’s what a WordPress site actually needs, without the legal jargon.
What GDPR Requires, in Plain Terms
Consent before non-essential cookies load. Analytics, ad tracking, and embedded video such as YouTube or social widgets all set cookies, and none of them should fire until the visitor actively consents. Implied consent from continued browsing is not sufficient.
A genuine choice to decline. A consent banner with only an Accept button and no equally easy way to reject is a common compliance failure, not a technicality. Regulators have fined sites specifically over this pattern.
Clear information about what you collect and why, in a privacy policy that’s actually accurate for your site, not a generic template that lists tools you don’t use.
A way for people to request their data or ask you to delete it. You need a process, even a simple one such as an email address that gets acted on, for handling these requests.
What This Means for a Dealer or Business Site
Contact forms, WhatsApp click-to-chat, live chat widgets, and CRM integrations all collect personal data such as name, phone number, and message content. Each of these needs to be covered in your privacy policy, and any that set cookies before consent is given need to sit behind your consent banner.
Practical Setup for WordPress
1. Use a proper consent management plugin such as CookieYes or Complianz, configured to actually block scripts pre-consent, not just display a banner cosmetically. This distinction is the most common compliance gap we see: the banner shows, but the tracking scripts fire anyway.
2. Audit what’s actually setting cookies. Analytics, embedded maps, social share buttons, and chat widgets are the usual list. Anything not strictly necessary for the page to function needs to sit behind consent.
3. Update your privacy policy to match reality, listing the actual plugins and services you use, such as Google Analytics, WPForms, or WhatsApp Business, not a boilerplate list.
4. Set a process for data requests. Even a simple documented workflow, such as someone checking a dedicated inbox weekly and being able to locate or delete a contact’s data, satisfies the requirement for most small business sites.
Getting This Wrong Is Expensive
Non-compliance isn’t just a legal risk in the abstract. Regulators across the EU have issued real fines to small businesses over consent banners that don’t actually block tracking. For a dealer site with visitors across Germany and the EU, this is worth getting right once rather than fixing under pressure later.
HD Web Mobile sets up GDPR-compliant consent and privacy configuration as part of every WordPress build. Ask us for a compliance check.