Launch Day GDPR Compliance: The Complete Checklist

## It's 11 PM and You're Launching Tomorrow We've been there. Product is ready. Landing page is polished. Stripe is configured. You're about to go to sleep. Then you remember: "Wait. GDPR. Cookies. Do I need... something?" You start Googling. Articles from 2018. Lawyer blogs about €20 million fines. Enterprise CMP websites that want you to "schedule a demo." Your launch is in 10 hours. Don't panic. Here's exactly what you need, in priority order, with time estimates. ## The 30-Minute Checklist ### Priority 1: Cookie Consent (5 minutes) **Must have for launch. Do this first.** 1. Go to [getcookies.co](https://getcookies.co) 2. Sign up (Google = fastest) 3. Add your domain 4. Copy this to your ``: ```html ``` 5. Deploy **What this gives you:** - [x] Cookie consent banner - [x] Google Consent Mode v2 - [x] Script blocking until consent - [x] Consent logging - [x] CCPA support (automatic) ### Priority 2: Privacy Policy (15 minutes) **Must have for launch. Do this second.** Options (free): - [Termly](https://termly.io) - Generator - [Iubenda](https://iubenda.com) - Generator - [PrivacyPolicies.com](https://privacypolicies.com) - Generator Steps: 1. Use a generator 2. Answer the questions honestly 3. Host at `/privacy` or `/privacy-policy` 4. Link from your footer **Key sections to include:** - What data you collect - Why you collect it - How long you keep it - Who you share it with - User rights (access, deletion, etc.) - Contact information ### Priority 3: Cookie Policy (5 minutes) **Should have. Often combined with privacy policy.** Your cookie policy should list: - What cookies you use - Purpose of each cookie - Duration of each cookie - Third-party cookies **GetCookies helps**: Dashboard shows what cookies are detected. Use this to populate your policy. ### Priority 4: Terms of Service (5 minutes) **Should have, especially for SaaS.** Same generators work: - Termly - Iubenda Host at `/terms` or `/terms-of-service`. ### Priority 5: Contact for Data Requests **Must have. Takes 30 seconds.** Add an email like `[email protected]` or just use your main email. Link it in your privacy policy. When someone emails asking for their data or deletion, you must respond within 30 days. --- ## The Full Checklist Copy this and check off as you go: ### Absolute Must-Haves - [ ] Cookie consent banner (GetCookies) - [ ] Privacy policy page - [ ] Privacy policy link in footer - [ ] Contact email for data requests - [ ] Scripts don't fire before consent ### Should Have - [ ] Cookie policy (can be section of privacy policy) - [ ] Terms of service - [ ] Cookie settings link in footer (GetCookies badge handles this) - [ ] Clear data retention periods in privacy policy ### Nice to Have - [ ] Custom consent banner colors - [ ] Custom consent banner text - [ ] Separate policies per regulation (GDPR, CCPA) - [ ] DPA ready for B2B customers - [ ] Data processing records ### Don't Need Yet - [ ] DPIA (Data Protection Impact Assessment) - only for high-risk processing - [ ] DPO (Data Protection Officer) - only for large orgs or specific cases - [ ] EU representative - only if you're outside EU with significant EU presence --- ## Quick Verification Checks ### Check 1: Cookie Consent Works 1. Open incognito browser 2. Go to your site 3. Banner should appear 4. Open DevTools → Network 5. No tracking requests should appear before clicking Accept ### Check 2: Privacy Policy Exists 1. Click privacy link in footer 2. Policy should load 3. Policy should mention your company name 4. Policy should have contact info ### Check 3: Scripts Are Blocked 1. In incognito, choose "Reject All" on banner 2. Reload page 3. Open DevTools → Network 4. Filter for "google", "facebook", "analytics" 5. Should see no requests (or only cookieless pings) ### Check 4: Settings Accessible 1. Accept cookies 2. Banner hides 3. Look for badge/button to reopen settings 4. Click it 5. Should be able to change preferences --- ## Framework-Specific Launch Checklist ### Next.js Launch ```tsx // app/layout.tsx import Script from 'next/script' export default function RootLayout({ children }) { return ( ``` - [ ] GetCookies script in head - [ ] privacy.html exists - [ ] terms.html exists - [ ] Footer on all pages --- ## What If You're Missing Something? ### Missing Privacy Policy? Generate one now with Termly. It takes 10 minutes. Use placeholder text if needed, then improve it later. ### Missing Terms? Launch without them if you must. Privacy policy is legally required. Terms are strongly recommended but not strictly required in most cases. ### Missing Cookie Consent? This is the highest priority. Without it, you're not compliant. GetCookies takes 5 minutes. ### Missing Cookie List? GetCookies scans your site and shows you what cookies exist. Use this to populate your cookie policy after launch. --- ## Post-Launch Improvements Once you've launched, improve compliance over time: ### Week 1 - [ ] Review GetCookies analytics for consent rates - [ ] Fine-tune banner text if needed - [ ] Complete cookie policy with actual cookie list ### Month 1 - [ ] Review and update privacy policy - [ ] Add DPA template for B2B customers - [ ] Document data flows internally ### Quarter 1 - [ ] Set up data deletion workflow - [ ] Train team on data request handling - [ ] Review third-party vendors --- ## The "We're Launching in 1 Hour" Version Absolute minimum: ```html ``` Create a `/privacy` page with even just: ``` Privacy Policy We respect your privacy. We use cookies for analytics and marketing (with your consent). For questions: [email protected] Full policy coming soon. ``` This isn't ideal, but it's better than launching with nothing. Improve it within the first week. --- ## Common Launch Day Questions ### "Can I launch without a privacy policy?" Technically, no. But a minimal one is better than none. Use a generator or write 200 words covering the basics. ### "Do I need GDPR compliance if I'm in the US?" If you have any EU visitors (you probably do), yes. GDPR applies based on where your users are, not where you are. ### "What about CCPA?" GetCookies handles CCPA automatically. Just focus on GDPR - it's the stricter standard. ### "Do I need consent for analytics?" In the EU, yes. Google Analytics uses cookies. Cookies require consent. GetCookies handles this. ### "What if someone asks for their data?" You have 30 days to respond. Cross that bridge when you come to it. For now, just have an email they can contact. --- ## Launch Confidently GDPR compliance doesn't have to delay your launch. With GetCookies: 1. **5 minutes** for cookie consent 2. **15 minutes** for privacy policy 3. **10 minutes** for everything else 30 minutes total. Then ship it. Your launch is more important than perfect compliance. Good compliance today beats perfect compliance next month. --- *GetCookies: Launch compliant. Improve continuously.*